MANNED SPACE PROGRAMS ACCIDENT/INCIDENT … · NASA CR-120999 MANNED SPACE PROGRAMS ACCIDENT/INCIDENT SUMMARIES (1970 -1971) Cranston Research, Inc. Alexandria, Virginia prepared

.~

.

..

NASA CR-120999

MANNED SPACE PROGRAMS ACCIDENT/INCIDENT

SUMMARIES (1970 - 1971)

Cranston Research, Inc. Alexandria, Virginia

prepared for

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

Contract NASW -2225

https://ntrs.nasa.gov/search.jsp?R=19730010170 2019-08-15T19:22:55+00:00Z

NOTICE

This report was prepared as an account of Government-sponsored work. Neither the United States, nor the National Aeronautics and Space Administration (NASA), nor any person acting on behalf of NASA:

A.) Make any warranty of representation, expressed or implied, with respect to the accuracy, completeness, or usefulness of the information contained in this report, or that the ule of any information, apparatus, method, or process disclosed in this report may not infringe privately-owned rights; or

s.) Assumes any liabilities with respect to the use of, or for damages reBulting from the use of any information, apparatus, method or process disclosed in this report.

As used above, "person acting on behalf of NASA" includes any employee or contractor, to the extent that such employee or contractor of NASA or employee of such contractor prepares, disseminates, or provides access to any information pursuant to his employment or contract with NASA, or his employment with such contractor.

Ir

• ,

~-

1. Report No. 2. Goveroment Accession No. 3. Recipient's Catalog No.

NASA CR-120999 4. Title and Subtitle 5. Report Date

MANNED SPACE PROGRAMS ACCIDENT/INCIDENT SUMMARIES (1970-1971) Anril 1972 6. Performing Organization Code

-7. Author(s) B. Performing Organization Report No.

10. Work Unit No. 9. Performing Organization Name and Address

Cranston Research, Inc. 11. Contract or Grant No. Alexandria, Vir~inia

NASW-2225 13. TVpe of Report and Period Covered

12. Sponsoring Agency Name and Addrass Contractor Report

National Aeronautics and Space Administration 14. Sponsoring Agency Code Washington, DC

15. Supplementary Notes

Project Manager, Charles W. Childs, NASA Headquarters Safety Office, Washington, DC

16. Abstract

This documdnt is a compilation of 223 mishaps assembled from company and NASA records covering the Accident/Incident experience in 1970-71 in the Manned Space Flight Programs. It is the companion volume to NASA CR-12099B which covered the years 1963-1969. The objectives of this summary is to make available to Government agencies and industrial firms the lessons learned from these mishaps. Each accident/incident summary has been reviewed by description, cause and recommended preventive action. The summaries have been categorized by the following ten systems: Cryogenic; Electrical; Facility/GSE; Fuel and Propellant; Life Support; Ordnance; Pressure; Propulsion; Structural; and Transport!Handling.

17. Key Words (Suggested by Author(s)) lB. Distribution Statement Accident prevention Unclassified - unlimited

. Accident investigation Safety management Manned Space Flight Hazards

19. Security Oallif. (of this reportl 20. Security ClI .. if. (of this pagal 1

21.

No. of PIgII 22. Price·

Unclauified Unclaasified 135 $3.00

• For sale by the National Technical Information Service. Srringfield. Vlfginia 22151

PREFACE

The objectives of the NASA Aerospace Safety Research and Data Institute (ASRDI) are:

(a) To support NASA, its contractors and the aerospace industry with technical information and consulting on safety problems.

(b) To identify areas where safety problems and technology voids exist and to initiate research programs both inhouse and on contract in these problem areas.

(c) To author and compile state-of-the-art and summary publications in our areas of concern.

(d) To establish and operate a Safety Data Bank.

In pursuing these objectives, ASRDI has assumed the responsibility for publishing two documents resulting from an effort initiated and supported by the NASA Headquarters Safety Office (DY).

The first of these documents is:

General Electric Co., Daytona Beach., MAnned Space Programs Accidents/Incidents Summaries (1963-1969~ March 1970, NASA, Director, Manned Space Flight Safety, NASW-410 (Safety Task), NASA-CR-120998.

This document is being reprinted to fill current needs.

The second of these documents is:

Cranston Research Inc., Manned Space Programs Accident/ Incident Summaries (1970-1971~ April 1972, NASA Headquarters Safety Office, Charles W. Childs, Program Manager, NASW-2225, NASA-CR-120999.

This is the initial printing of this report.

iii

Frank E. Belles Director of Aerospace Safety Research and Data Institute

II

FOREWORD

This document has been compiled to update the Manned

Space Programs accident/incident experience information pre

sented in NASA Safety Program document, Manned Space Programs

Accident/Incident Surrunaries~ dated March 1970. It should be

used in conjunction with the March 1970 document to obtain

full visibility of the ways of preventing repetition of

accidents/incidents in future programs.

The March 1970 docwnent is based on accidents/incidents

experienced in the calendar years 1963 through 1969. This

UOCl~nt is based on accident/incident experience in the

calendar years 1970 and 1971.

The statistical information in this document includes a

restatement of the significant statistical information in the

Narch 1970 Swrunariec for comparison with the new information;

and an integration of the total information to provide statis

tical swnmaries covering some nine (9) years of Manned Space

Program activities.

As with the March 1970 document, the compilation of this

document was made possible through the understanding and support

provided by management and safety personnel of NASA Headquarters,

NASA Field Centers, and NASA contractors.

v

Tl\BI,E OF CONTE11TS

PMT I - INTRODUCTION T •

A. Purpose & Objective

B. Information Sour~es

c. Criteria Used

1. Des<:riptions

2. Causes

a. Hardware Deficiencies

b. Software Deficiencies

3. Recommended Correetive/Preventive Action

PMT II - STATISTICl\L SIDfll\RY

A. Approach

D. Findings

1. Distribution by Systems

2. Distribut:ton by Cnuscs

3. Dlstr:ibution by PrQgram Activity

1! .• Distribution by Accidents vs Incidents

5. Distribution by Nork Shift

6. Distribution by Calendar 0uarters

7. Injuries/Fatalities/Damage

B. Htunan Error

vii

Page

1

2

2

3

4-

4-

5

7

8

8

8

9

11

12

12

13

13

111

PART III - ACCUl.ENT/INCIDENT StJt.t1ARIES

SectJon I - r.ryo~enic !iystems

Section II - l:lcctrical Systems

!lcction III - Focility/G!iE Systems

.~(!ctiOl: IV - Fuel and Pl' opellnnt Systems

;;ectlon V - Life Support SystelllB

Section VI - Ordnance Systems

Section VII - Pressure Systems

~ectioll VIII - Propulsion Syr.tems

Section IX - Structural Systems

See i:'lon X - Transport/1I3n<nin~.; Systems

}\PPT:NDIX - Glossary of l\bbreviations t

}\cronyms and Terms

viii

21

35 ~

72

73

83

95

102

104')

129

PART I, INTRODUCTION

A. Purpose Clnd ObJecti~

This compilation of accident/incident infonaation relative to

srace Dro~rams has been pi~epare(l as "a::::-t of the t.JJ.'\SA Hanned

Space F:a~~Il"i: Sa:::ety Pro~ram. The basic documentation of this

in:l:o;.~mation is cOJ1.:ainec, "n t!ASb Safe-ty Pl'oc;rmn 00(,' qent,

~1anneJ Sl')oce Pro~Tra;,m Accic;ent/Inci(1ent Sur,.naries, r.larch

1970, on exper~_el1('e tl':"'oa~:, the ec:lenc'.ar ~'ears 1963-1909.

Thb joclunent i~ em 11~)tlate 0"- the basic (loC'ament to Gd(;

accident/incident exoeriene:e ~ained llur:in~~ calendar /ears

1970 and 1971. Tile oiJJertive of th11" C'ompilc:tion il'l to con

tri0:..tte -::0 sa::-et~ :-:' ,nal~in!", ava ilahJ.e to nOVp.rn(;lellt agencies

an .. inclu:"triDl COn~el":l:'; ~lle s.i.;;nj.:Ucant 1(':';30'15 lpal'l-,cd from

the acc iC:eilt" / inc ic:ent e:q.)(~ r ie'1ce of ~!annel, Space Fli~~ht Pro

grams. No re:e1'eI1l'e las uee!; :nOGC' in tile ;'lIJ11r:la:'i(!s as to

locat:"on, facili.t.Lc3, ,~ompan:i_cs, or:,,;oilizations, pr'ol:ucts,

pro;a-ams, or illdh illuals hwo1ve,.;. T.le (iO('I',mellt ;1a5 l)e~11

preoal'ed priIl1Di.·il:' for i::1E" l,;oc-oi w.imw;e'';1cnt, r.t:pervisory,

en~ineerinr.;, ant; safet~1 flcrsonnel on spacc pl'Clgra:ns. For most

~:[fective use in IU'i.:ure programs, .1JIC indivillual accidents/

incidents recorticd berp.in :nust be interrn'c"ccd ~y ~ror~rar.\ speciul

ists for applica·tio:1 to pot~ntial h.:tzarus of the particular

pror:ram or s~'5terns involveu. 1'01' the Dssjstance of il1ana~ement

in evaluating the poten1' ially haZa11 (1011S p:,ases of a program,

statistical summaries of cause factor:: allt ot .er significant

1.

information pertaining to accident prevention in future pro-

grams has been provided.

B. Information Sources

The swnmaries contained herein \lIere compiled. from existing

llOClunentation of accidents or incidents on ~lanned. Space Flir;ht

Pro~rams. In compilin~'; the basle document, approximately

10,000 case documents were reviEwed, from \lIhich a total of

509 summaries tllDS selected. Records reviewed included exist ..

in:3 rcc Ol'ds of Nl\Sl\ H('c:uquarters, N..'\S/I F iclc1 Centers concerned

with space prosrams, anu eighteen (18) contractors, associate

contractol~!:' and subcontractors on space programs. In cornpilillS'

the information for this (locument, over 5000 case documents

\'lel~e rev ie,-Ie d at Nl\Sl\ Headquarters, NASA f :telu centers, and

five (~) major contractors, reculting in the selection of an

ac:ditional 223 summaries. No attempt \'Jas made to E;t.ITnmarize

anomalies "':lic~l occurreu c1urint"; manne(l space flight missions.

Tl:e majority of the accidents/incitients selected occurred

c.urin::::,; various phases of the Apollo Program with the rer.lainder

selected from other manned space programs.

C. Criteria Use0

Each accident/incident summary contained in Part III has been

SWlll1larfzed by description, cause and rccQl,11l1endeli preventive/

corrective action. The criteria used f01' each of these surnr;1ary

sc~ments are defined below:

1.1·

I:

Ii Ii II i1

2.

-.

1. TJescr ilt.: ipn,s

Acciden~s/incj.dentS' \·lere selected from records on the basis

of the follOtdng criteria:

B. l-n occur:::oe.!1ce \Jldch reflected e sir,nificant lesson of

importa.'1ce to future ,rogramG.

b. T;le occurrence involved space p .. 'o~rams rU.rrht vehicle

syster,ls, hal'C\·mre o!' ~oLll1l1 suppor·' equipment an~

facHitieG pro\'iL:i.:-:g l .lrect sapl?or~ to ~pace ,rograms.

c. T)e occurrence rC!sub:ed iro pe!:Gonnel fatality/inju:.'y,

and/or ceLl~ed damage to program s;·::r!:ems, hard\~are,

G~E and ::acil:i_ties or- resulJ.:eJ in a potentiall/ hazard

OllS conc j:: ion.

T-'e desc:ri9l:~on for eaC~1 e.cC'::'.-"iellt/incideni: relates l..;hat

hap?enecl; :-i.O\"i it lIa!)peneC; t:,e ~ha3e of the pro:!r'9m £cti'litr

involved; harc1\>}sre. eql'ipmcnt a;lci/ol." jacilities daman-ed;

personnel in.;:1ri_e~ a,:(: ~£ltalit:i.es fncurred or 90tentinl

hazards created.

The llcscriptj_on ot \'1hat ;lt1.9pcner:~ has included the event that

caused the accident/inciclent to occur. For eXafil?le, Ha gage

blew up and iJi.-jure([ one person d1lring (,evelopment test of an

en~ine, dlE to inadvertent cross connection of hi~ and lOt~

pressure sys·i:ems.': Here, the first orGel' cause factor was

inclurleti as J1£1rt of the description of what happene~ and per

mits concentration in the cause section on the second order

of causes related to ,'lh",' it happenec. This 'lias done because

3.

it is believed l::1St too often cause factors have not been

identified in sufficien i: depth to provide guidelines for

management or supervisor~' corrective programs.

2. Causes

The causes identified in the "Cause" sections reflect the

judgment of the reviewing teams based upon information pro

vided in the accident/incident records. In many cases, tr.e

repo!:'ts were supplemented cy discussions ,dth key people

to r:lore accul.~ately identify cause factors. The second order

cause factors consiclereu \'lere h~rd\,lare or Q,oftware ueficiencies,

as de"!:ermined b:' the following criteria:

a. Hal'dwBre Deficiencies

o ~~teriBl Failure - Material :failure as used in cause

o

detel'millatJ~ons \'las defined as any failure of lTIaterials

or' components in development tests at less than design

specification or failure under operational conditions.

Design Deficiency - T!1is cause factor was defined as

an~' desi;;J1 specification inadequacy, resulting in

deficient hardware \,11·;icfl contributetl to the occurrence

of an accident/incident. Factors considered \'Jere

omission of essential information, failure to specify

safety clevices or warnings, failure to determine

stress/fatigue and otller operational/interface factors,

errors in material selection, or clerical errc:rs in

cl.ra\'Jinr;s anLl specifica·tions.

;,·:··1-·; I! . I,

I: I . .

i " ,. i; .

4.

o

o

Haterials Incanpatibllity - Materials incompatibility

was defined as any cause in which incompatible

materials were brought tozether through a design

error, installation error, or procedural error.

Malftmctions - Malfunctions were defined as any

anomaly where a system, subsystem or component failed

to function as intended, resulting in conditions

which contributed to accidents/incidents.


o

o

procedura} - A procedural deficiency was defined as

any case in which formal procedures contributed to

accident/incident causes as a result of failure to

9repare procedures, failure to follow procedures,

deviations from procedures during a test, failure to

coordinate cmcurrent tests, omissions of essential

information in procedures, cle:r.ical errors in pro

cedures, use of wrong prOCeQLWeS, or failure to up

date procedures.

Planning - A planning deficiency was defined as any

case w:1erc the cause of an accident/incident was due

to failure to properly plan prior to an event. In

cluded in these considerations were lack of or

inadequate test planning, failure to perform pre

operations hazard analysis, deficiencies in planning

for transportation, handling Bnd storage. and failure

to determine necessary equipment and personnel re

sources for an operation.

5.

o

o

o

o

l'1ork Control - ~lork control deficiency was defined

as any condition contributing to an accident/incident

during installation, maintenance~ storage, cleaning,

_ repair,_and fabrication of systems. Factors con

sidered as work control deficiencies were inadequate

records, inadequate area control, failure to exercise

proper control over materials, failure to properly

mark and identify equipment and failure -to define

work requirements.

Management/Supervisory - This cause factor was defined

to include errors in decisions, policies, or direct

ives which contributec1 to the occurrence of accident/

incidents. Included was failure to perform manage

ment or supervisory responsibilities for planning;

training and certifying personnel; and failure to

perform personnel surveillance of critical activities.

Training - This category was defined as any deficiency

in workmanship or lluty performance in which lack of

training, briefing~ certification or specific work

jns·tructions contributed to an Bccident/incident.

Inspection - All inspection deficiency was defined. as

Bny condition contributing to an occurrence in which

inspection was involved through failure to verify,

failure to maintain inspection records or errors in

inspect).on records.

..

6.

3. Recoll1l1end!,d CorrectiveL:rreventive Action

In this part, an effort was made to reflect all recommenda

tions included in the reports reviewed. In many cases,

recommended corrective/preventive actions in individual

reports were l<eyed solely to the one event t and not necess

arily broadly applicable to other similar events. In those

cases t the recanmended corrective actims were evaluated

and extrapolated for application generally to like systems

on future programs. Also, since CBllse factors were con

sidered in terms of hardwar~ or software deficiencies, the

recommended corrective/preventive action was generally

oriented to tl:ese cause factors.

PART II. STATISTICAL SUMMARY

A. Approach

The statistical information presented in this document is de-

signed to present graphically that information considered to

be of value to management. The charts at the end of this Part

show the distribution of accidents by system categories, cause

factors and program activities. The information provided in

these charts represents accident/incident statistical informa-

tion over an approximate nine (9) year period. In each chart,

a bar-graph is presented to show accident/incident experience

over:

1. The 1963 through 1969 period (March 1970 Summary period)

2. T:le 1970 and 1971 period (update period)

3. The 1963 through 1971 period (total period)

B. Findings

By the method of display, management is provided with a basis

for relatin~ program events to accident/incident data for the

time periods shown. Some of the more sig-nificant infonnation

shown in the charts is summarized belO\'J. Although the accidents/

incidents in the 1970-71 period generally followed the same

distribution as the EIG3-69 period, there were some significant

chan~es over the last two (2) years.

1. Distribution by Systems

Of the ten (10) system categories shown in Chart 1, Pressure

Systems and Facilit~I/Ground Support Equipment were the two

'I' -·-··f·.~·!··-1- ;

1 :

i: ; I' ,

8.

systems having the highest percentage involvement over

the total period; although there was a significant de

crease (23% to 9%) in Pressure Systerr.s involvement, and

a significant increase 0-8% to 35%) in Facility/GroWld

Support Systems involvement in the 1970-71 period. The

percentage involvement over the to-cal period for these

systems \'Jere:

B. Facility/Grolmd Support Systems 2(t~~

b. Pressure Systems 19%

Ordnance Systems continued to Shot>l the lowest involvement,

with no recorded accident/incident in the 1970-71 period.

2. Distribution ,by Ca~se.s

T,le distribution of acc:dents/incidents by cause factors

is shown in Chart 2. Software ceficiencies were a greater

contributor to accidents/incidents than Hardware deficienci~s;

and procedures, work control and inspect:'on were the most

significant Software cause factors.

a. Hardware Deficiencies

Hardware deficiencies t'l1ere, for the most part, related

to design deficiencies. The numb er of cases i.n which

design deficiencies contributed to or caused accidents/

incidents was significantly higher than those caused

by material failures or malfWlctions, although there

was a Significant decrease (37% to 17%) in design de

ficiency causes in the 1970-71 periocl. In 31% of the

9.

732 cases, a design deficiency was identified, whereas

only S% of the cases .involved material failure as a

cause and only 6% involved malfunctions. Material

failure causes increased (3% to 8%), and malfunction

causes decreased (8% to 1%) in the 1970-71 period.

Cases involving malfunctions occurred mostly during

operat ional tests and manufacturing checkout. Like

\lise, the nU1i1ber of cases where material incompatibility

contribu"ted to the cause of accidents/incidents was

relatively small, only 3% of the 732 cases; however,

sor.le very Gel'iou5 accidents occUl'red as a result of

this factor.


The number of cases involving procedural deficiencies

\-1aS r:::ignifican"1:1y high and constituted the single

largest contrihutor to accidents/incidents causes \'lith

If9;~ of the 732 cases. Like\')ise, the number of related

\'lori~ control lleficiencies \-1<1S quite high. This areD

Nns a very s:i.~nificant factor :in acc:illent/incident

causes and consti"tutell the second la!'p;est contributor

with 3:~;'~ of C;le 732 cases.

Nanap;ement or supel'v:isory deficiencies were involved in

7% of the 732 cases. Six percent (6%) of the cases in

volveCl Elannin~ deficiencies and 9% of the accidents/

incidents involved training deficiencies. In many

III

10.

cases, training deficiencies pertained to inadequate

ImO\lJleC:ge of the total operation. Individuals \4ere

not \'lell enough informed of other work going on con

currently and/or what the previous shift had done as

shown byi:he fact that 3% of the accidents/incidents

involved lailure to tl'ansfer essential information

during shift chal1,qes. Although jpspecticm deficiencies

were not the primary cause of accidents/incidents, in

spection was a major contributing factor since many

accidents/incidents could have been prevented hac there

been sufficient an(l timely inspection and verification.

For example, in 3% of the cases, there were cross

connect isms of lines or cables which could have been

prevented by inspection. Twenty-three percent (23~

of the accidents/incidents involved inspection defici

encies.

3. Distribution br Program Activity

As records were reviewed, the accidents/incidents were identi

fied to a program activity. The results of this compilation

are shot'111 in Chart 3. As sho\'111 in the chart, more of the 732

accidents/incidents occurred durin~ operational test and

checkout than in any other prograr,l activity, accoWlting for

45% of the total. Hanufacturing t'las also a Significant

source of accidents/incidents, \'Jlth 34% of the cases occurring

during this activity.

11.

4. Distribution by Accidents VB. Incidents

The distribution of accidents/:fncidents was based on .

NHB 1700.1 definitions (Type A, Type B, Incident) and the

identifications in the case documents reviewed. The

distributions are:

Period

1963-1969

1970-1971

1963-1971

Accidents

17%

13%

16%

5. Distribution by \vork Shift

Incidents

83%

87%

84%

The statistical summary of accidents/incidents by work

shifts revealed a rather direct relationship to the level

of activity or the number of people involved in each shift.

\'lith most of the work done on the day shift, as would be

expected, the majority of cases occurred on the first shilt.

Alti10ugh risks may have been higher, per level of activity,

on second and third shifts, data was not available to make

this correlation. Distribution of cases by shift was 8S

follows:

Period

1963-1969

1970-1971

1963-1971

First Shift

65%

81%

70%

Second Shift

26%

12%

22%

I

Third Shift

go,.,.;

7%

8%

12.

6. Distribution by Calendar Quarters

The seasonal distribution of accidents/incidents by calendar

quarters was compiled as follows:

1963-69 1970-71 1963-71

First Quarter 29J6 30% 29% (Jan., Feb., Mar.)

Second Quarter 2l~% 211% 24% (April, May. June)

Third Quarter 27% 22% 25% (July, Aug., Sept.)

Fourth Quarter 20% 24% 21% (Oct., Nov., Dec.)

This distribution could not be correlated to any particular

factor, and the variation in tiistribut ion was not enough to

be significant.

7. Injuries/Fatalities/Damage

Records compiled on percentage of accidents/incidents which

involved in juries, fatalit ies. or dan18ge shO\\led the follOt\ling:

% OF THE TOTAL

1%3-69 1970-71 1963-71

Injuries 15~~ 20% 17%

Fatalit ies 1°' loJ ~ 1% 1°' 10

Damage (hardware, .facilities, 68% 66% 67% equipment)

In a number of the cases, personnel injury or fatality, as

well as damage, occurred. A nlmWer of incidents were included

in the summaries where there were no injuries. fatalities, or

damage, but the incident created a high hazard potential. For

13.

these reasons, the percentages shown do not cumulatively

represent all the accidents/incidents summarized.

8. Human Error

Separate emphasis was not given to human error in identify

ing cause factors unless it was apparent in a report, be

cause human error would be present to some degree in most

unplanned events. Emphasis was placed, however, upon

determing what caused or contributed to the human error

and, as the accident/incident recordS were reviewed, a

notation was made as to whether or not human error was

directly involved in the cause of the accident. Based upon

a simple ~ or ~ determination of direct or indirect human

error involvement, the following percentages of cases in

volved human error as a factor to the cause of accidents/

jncidents. The majority of these cases involved second

order causes. Human error involvement could probably have

been identified in the rema inder of the cases had more in

formation been available:

1963-61)

1970-71

1963-71

72%

73%

The f ollow:ing percentages of cases, where an :indiv iuual act

of carelessness or irresponsibility at the time of the

occurrence \vBS the only cause, \-Jere identified:

III

]4.

1963-69

1970-71

1963-71

<1%

~fo

"'" 3%

In practically all the cases there were indications that

management and supervisory deficiencies were indirectly

involved in accident/incident causes even though deficiencies

were not specifically identified in the reports and documents

reviewed.

15.

..... C'I

.... C\!

..j..)

~ ..... o ~

25.-

20-t-

15-t-

10-t-

5~

-

PRESSURE SYSTEMS

-23

-19

FACn.1TY/GSE SYSTEM:;

TRANSPORTIHANDLING SYSTEMS

FUfL/PROPILLANT SYSTEM3

I -18

ELEC'l'RICAL SYSTEM;

c=J 1963-69 Distribution

~ 1970-71 Distribution

III 1963-71 Distribution

CRYOOENIC SYSTEM;

-13 PROPULS Ioo SYSTEMS

-10 "";-10 LIFE SUPPORT SySTfMj

STRUCTURAL SYSTEl-S

7 I -, ORDNANCE SYSTEm

_4 I

SYSTEM

CHART 1 - DISTRIBUTION OF ACCIDENT/INCIDENTS BY SYSTEM

r- 3 -2

r-4 III

t f-I

70

~5 ~ .... U III ~

cu 41 ~ CD U

III

III .ct;

"d cu > 'd > r::

1-4

'*-

I-' -~

iROCEDURAL

-57

Software Deficiencies

WORlC CONTROL

34 INSPECTION

.TRUNING

PLANNING I

MANAGEMENT

ISUPERVISION SHIFT CHANGES

-7 I

CAUSE FACTORS

Hardware Defici

o 1963-69 Distribution



DESIGN 1_

37

31 MALFUNCTIONS

MATERIALS 'INCOMPATIBILITY

_8 -6

CROSS CONNECTIONS

MATERIAL IFAILURE

-8

5 -3

CHART 2 - DISTRIBUTION OF ACCIDENT/INCIDENTS BY CAUSES Note: Several Cause Factors Could Be Involved in the Same Accident/Incident

I-' en

...-f «!

+>

~ fo-4 o ~

5

4

3

2

1

- 47 OPERATIONAL TEST & CHECKOUT

_ 43 MANUF ACTURING

DESIGN & DEVELOPMENT _12 TEST

-Un-ll 9 .-10 INSTALLATION, MAINTENANCE

- 6

PROGRAM ACTIVITY

NOTES:

1. Design and development tests are those cases in which an unplanned event occurred during Qualification or Development testing.

2. Manufacturing includes those cases involving functional checkout of systems, subsystems or components.

3. Installation and maintenance includes all cases occurring during installation and maintenance o,f facilities, systems, GSE or flight systems.

4. and checkout includes mbled vehicles and all sites, including

tests and pre-launch

c:J 1963-69 Distribution



CHART 3 - DISTRIBUTION OF ACCIDENT/INCIDENT BY PROGRAM ACTIVITY

i-' \0

50.

51.

AccIdent/Incident DescrIption

During LOX tanking from barge-mounted storage tanks, the replenish pump on the barge caught fire internally and exploded, resulting in a fire and damage to thp. barge and adjacent barge and dock area.

During planned LOX discharge from a storage tank into a drainage ditch ~hree automobiles in the area caught fire and were destroyed. One driver narrowly escaped severe injury.

SECTION I CRYOGENIC SYSTEMS

Causes

Failure of monitoring personnel to note and report abnormally low pump radial bearing temperature. Contri b1lting were material failure in that the pump shaft thrust bearing failed due ~o an oil BE'al lle.ak at 50 psi pressure; and inadequate design in 1-javing no automatic slg~al to warn of abnormal pump condl~lonB.

Personnel error in th~t PMployees who were handling the rOlld block operations, during the LOX discharge, drove llutos into an area where LOX vapor clouds were present. Contributing we~ inadequate controls and procedures governing movement or activity in areas where LOX vapor clouds c~ be ~ticipated.

Recommended PreventIve/CorrectIve

ActIon

Designate all LOX handling operations as hazardous and require training and certification of all personnel. Require use of welded stainless steel oil seala rated at 150 psi for LOX pump applications. Require all LOX-handling equipment monitoring instrumentation to pro vide automatic warning of abnormal operating temperatures.

Designate LOX discharge operations as hazardous and require s~ety inspection ~d approval prior to any discharge. Ensure the placement of area caution and warning devices prior to LOX discharge operations and/or institute positive traffic control procedures 'lround LOX discharge areas.

I\) :::l

Aooident/Inoident Description

52. While a H2 sample W'3.S

being prepared for analysis on~ of two cryogenic sample co:t1e discs ruptured and :ne gas ignited, injuring one employee.

53. During manufacture checkout of a spacecraft cryogenic shelf, metallic chips were detected in the c,ryogenic disconnec~ and in the ground half pressure operated disconnect (POD) of tank 2 vent line. Chips also were found in tank 1.

SECTION I CRYOGENIC SYSTEMS

Causes

A mat~ria1 deficiency in that the disc was extensively corroded and failed under working gas !)ressure. Contributing causes were inadequate quality control which failed to detect the corroded disc, and a test set-up which aimed the disc end of the cottle toward technicians.

Inadequate work control in that cryogenic vent lines were not properly cleaned after trimming as required. Contributing was QC failure to detect the contaminated parts.

Reoommended Preventive/Corrective

Aotion

Ensure periodic inspection and certification of all cryogenic sample bottles. Ensure that test equipment configuratlons pro'fide adequate protection to personnel from hazards of pressurized sample bottles.

Ensure that personnel are trained and certified for their job. Require strict QC during each step of the cryogenic system assembly and installation, ,

l\) ~

ACCident/Inc1dent. De scrl,pt10n

52. During operational testing and checkout of a spacecraft vacuum pump electrical unit, 28 volt circuitry was subjected to 115 volt main supply due to cross connections and sustained irreparable d9.Illage to several ci!'cuit components.

53. While a set of nicklecadmium tatteries was undergoing trickle charge in the course of a charge-discharge cycle, one of the cells shorted, overheated and caught fire.

SECTION II ELECTRICAL SYSTEMS

Causes

Inadequate quality co~trol during m~,ufacture of the unit in that the wiring harness of the unit had been erroneously assembled and permitted 115 volts supply to flow into circuits designed to accept only 28 volts.

Deficient battery conctitloning procedures in that the charge-discharge cy~les used were too severe for the batteries being employed.

Recommended Preventive/Corrective

Action

Require development and use of circuits continuity checkout procedures for post-assembly verification of electri~al units. Ensure that such procedures recei-/e review and concurrence by corr.petent englneering authority.

Designate battery conditioning operations as hazardous. Require safety review/ analysis of condltioning procedures to ensure procedures compatibility with the batteries being processed.

I\) I\)

54.

55.

Accident/Incident Description

During a training flight, a space flig~t training vehicle :os~ i':,8 primary electrical system and crashed when the a~titude control system (ACS) failed. The vehicle was destroyed and :r.e pilot received minor injuries during ej~ction.

\vhile performing PM on an electric main breaker panel, a workman using a wire brush to clean inside the panel made contact with energized stabs, receiving second and third degree burns.

SECTION II ELECTRICl\L SYSTEMS

Causes

A design defici~ncy 1~ that the ACS could not be ~witched fro:;] prir.tary 1;0 emergency electrical power with the e:!gine at fligtt RPrlT. ContrIbuting causes were inadequate check-ou+ procedur~s which failed to lrerify emergency swi tchover functions at engine flight RPrlT, and ':h~ n,:;ed for multiple relays ~o operate sImultaneously to switch in emergency ACS.

Failure to follow required procedures in that the pan31 was not de-energized prior to ceginning maintenance operations. Contributing ~as the use of i,mproper equipment; wire brushes were prohibited for cleaning electrical system components. Also, inadequate training in that the workman incorrectly used a test instrument to verify the panel was de-energized.


Action

During design of complex flight systems ensure that hazard analyses are performed on all electrical circuits controlling switch OV0r from one system to another to determine. integrity of relays under all power settings. Require all flight control systems to be tested and certified for actual flight conditions.

Ensure positive verification of circuit deactivation prior to allowing electrical work. Ensure that all tools used with electrical consoles are nonconductive or are specifically certified for use. Require training of all personnel assigned to work on electrical systems.

I\)

0J

56.

57.


During a m~nuf~cturing checkout of a spacecraft module caution-and-warning system power supply unit~ a signal input lead was disconnected from the test oscilloscope, as part of the test sequence, and was accidentally grounded, causing an arc and ·burning the C&W power supply.

During assembly electric~l insulation resistance test of cables installed on a flight unit, a power supply and two control accelerometers were severly damaged due to the application of reverse polarity.


Causes

Test set-up design de-ficiency in that the test lead between the oscilloscope and the power supply unit contained no over-current protective devices. Contributing was personnel error in that the oscilloscope was connected with its chassis ungrounded and electrically "hot"; and procedural deficiency since no detailed circuit hoo~ up instructions were provided the technicians performing the work. Inadequate procedures in th~t the inspection verification of the set-up configuration prior to test was incomplete. Contributing was human error in misreading test set-up engineering drawings during test setuP.


Action

Require that circuit-protective current-limiting devices be installed in test leads used on spacecraft electrical systems. Ensure that technicians used to test flight systems are trained and certified for the work. Require the use of formal procedures and checklists with QC verification in making test set-ups.

Require formal QC inspection verification of test configurations prior to initiating test of critical components. '

f\)

+="


58. During assembly cellmatc,ing sequence test on a number o~ flight batteries, a battery cell explosion occurred, due to excessive internal pressure generated b:,r major cell overcharge/ over-temperature, resulting in minor damage to test equipment and the test ~acility,and destruction of the battery.

59. During battery charging in a launch operations battery shop, a battery ce 11 overheated .and ruptured destroying the battery.

60. During manufacturing assembly of an electrical wiring harness for a spacecraft, the harness cover pressed a deep indentation into a wire bundle cover, necessitating replacement of the bundle cover.

SECTION II ELECTRICAL SYSTEfiIS

Causes

Deficient test assembly procedures in that verification of the proper test set-up was not made prior to test initiation. An installation error in assembling the test set-up was made which inhibited automatic test shut down when battery over-temperature was encountered. Contributing cause was failure to communicate test information (over-temperature conditions) during shift change.

Inadequate inspection procedures in that a weak cell had gone undetected, and it overheated at standard charge rate.

Inadequate work control in that there was improper storage of wire harness whe~ the harness cover was installed.

,,'

Recom.'nended Preventive/Corrective

Action

Require QC inspection and verification of orooer test configuration prior to initia~ion of cell sequenc-ing tests. Establish procedures/checklists for transfer of essential test information at shift changes.

Require inspection and test of battery cells for cell condition qefore start.1ng charging cycle.

Ensure that procedures for electrical harness cable assembly include a cautionary note to verify proper storage of wire harness before installing cover.

I'\) IJ1

61.

62.

Accident/Incident Descript10n

During nickle cadmium batte~T condi tioning at a test facility, a cell overheata1 resulting in emission of s~oke and fumes and necessitat!ng area evacuat.ion. 'The battery had to be rp.pl~ced.

Duri:1.g manufacturing checkout of an 02H2 burner sparks system, 3. sr.ort occurred on one burner spark circuit, resu1~lng in excessive current to the circuit and burnout of the spark exciter and ancillary circuitry.

SECTION II ELECTRICAL" SYSTEMS

Causes

Material f3.ilure in that the batte~f failed ~nternally while under normal charge cordi~ior8.

Personnel p.rror i:1. that t!1e connector to the sp3.rk exciter had been 3.sse~blad with a misallgned pin, whi~:1 shorted to the connector sr.ell; and i~~dequ3.te monitoring o~ meter p~els in ~he ~est control cen~er during the trial run.

Reconunended Preventive/Corrective

Act10n

Designate bat~ery conditioning areas and operations as hazardous and ensure that all area personnel are instructed in emergency evacuation procedures.

Req~ire QC certification ~fter assembly or installation of electrical components or flight hardware circuitry. Establish procei'l.'res for megger- pre-1:.est':;'ng hig~ 'TO ltage r:ircuit sections for potential gro~nding. Ass~re that control center monitoring procedures during test runs are adequate. Where possible, equip sa:l~ty critic3.l or operationally critical meters with overcurrent alarms.

I\) 0\


63. ;)uring manufacturing assembly of ~ spacecraft, an engln~ gl~:al electrical switch toggle was broken off its pa.'1e 1 d'-le to an unknown in:pac t •

64. During c.ertificat10n testing of a power supp 1:,.' unit, th ~ unit and a l~lnch vehicle data '3.dapter teing used in the test were damaged due to an electrical fal;lt.

65. DUring acceptance testL1.g of a command deceder unit, 'ehe unit was damaged when it was electrically shorted between terminals of a digital voltmeter being 'lsed to conduct the test.

SECTION II ELECTRICAL SYSTID~S

Causes

In."l.d~quate assembly proced~lre" in that protectl'fe covers for the switch toggles were not provide0.

Ii'ai l'..t:"e to fo 1101.01 required procedures in that test sP.t-up cables wer~ modifIed to accommodate test conditions witho'--lt engine~ring appro fal and ¥ithout inspection, resulting in misconnection of test pcwer.

Inadequate test procedures in that the shorting link between the voltmeter ter~inals was not removed prior to proceeding with the test.


Action

Require use of protective covers/caps for fllght electrical eqUipment dl~r::"ng assembl,Y to avoid in'3.dvertent damage.

Require that all rr.odifi-::ations of test set-up configurations and tp.st procedures which involve critical ],ardware te approved by competent ensineering authority. Require QC inspection of appro'led test eqUipment changes prior to testing.

Require formal procedures and checklists to verif:: proper test set-up conditions prior to beginninb test. Conduct hazard ~~alyses or tes~ procedures to identify a..'1d prevent pot:mtlally hazardous e7ents.

I\) -.,J

66.

67.


During vibration testing of a launch vehicle digital computer (LVDC), the LVDC was excessively vibrated due to incorrect mounting location of a test control accelerometer, resulting in damage to the LVDC.

While sp~cecraft systems were being tested in an assembly and checkout facility, output voltage on the 28 VDC test power s-Jpply rose to approximately 50 VD~, sutjecting the 8pacecr~ft MN bus A and E to a voltage level of approxlmately 45 VDC for 43 seconds.

SECTION II ~LECTRICAL SYSTEMS

Causes

Deficient design of test set-up i~ that the mounting location of the control accelerometer on the test fixture was not identified with any markings or reference designation, and there was an additional unmarked and unused mounting hole on the fixture.

Random material failure, since a transistor in the power supply regulator circuitry failed. Contributing was the lack of overvoltage sensing and protecting circuitry which would shut down the power supply in the event of an over-voltage condition.


Action

Designate vibration testing of flight equipment as safety cr'itical. Ensure that s.et-up drawings provide posit1ve 1dentif1'cation of mounting location of test hardware. Requ1re QC inspection and approval of test conf1gurations pr10r to test.

Prov1deover-voltage sensors in electrical test set-ups wh1ch will cause the output of the power supply to be interrupted if the output voltage reaches established limits at any time.

f'\)

1.-8

~j.----'-"-- --


68. A technician crawled under a cathode ray tu~e unit at a test facility to perform routine adjustments with the power on and his shoulder came into contact with a 14 KV terminal and received an electrical shock.

69. During work on a 28v power supply a technician's metal watch bank shorted out against an electrical terminal and burned his wrist.


Causes

Personnel error in not shuting off power prior to work. Contrib~ting were lack of procedures for specifyl!1g conditions for work performance and a design deficiency in that adjustment controls were not easily accessible.

Personnel error in wearing a metal watch band while working or. an energized circuit.


Action

Ensure that for all high capa~ity electrical units, procedures are established specifyi!1g safety requirements for maintenance and operation. Ensure that adjustment controls are placed in ~cceseible locatio~s.

Ensure that personnel working on energized circuits do not wear metal watch bands, bracelets or other objects which can inadvertentl~' come into contact with power sources. Ensure that hazards and safety precautions in working on energized circuits are adequately covered in tra.1ning courses.

f\) ~u


70. While doing work in an ordnance storage facility a workman plugged a portable power saw into an extension cordmd recei~ed minor electrical burns when se-v'ere arcing occurr'ed.

71. During test operations at a test facility a power S'IlPP ly pane 1 being inserted into a pan~l ::>ack on ~ test, set cont~cted a 11C~A~ circuit breaker termlnal in an adjacent p~n~l ~~d sustained minor arc d~~age. Circuit breaker action prevent~d major damage.


Causes

Personnel error in that the wor!cinan failed t.o insp~ct and maintain his equipment prop~rly, Since a ~et screw was missing from the male plug, causing a short circuit md arcing.

Improper handling in which ~he technicians allowed the pan~l to tip out of position. Contrjbuting was procedural in that rack power was not switched off prior to lr.itiatlon of installa~ion work.


Action

Ensure that procedures provide for inspection of electrical plugs and connections prior to issue and use of electrical hand tools. Require safety certification of electrical hand tools to be used in ordnance and flammable material storage areas.

Ensure that electronic technicians are trained in proper equipment handling proc~dures and certified for their job. Ensure that work procedures specify turning off rack electrical power prior to inserting additional units in panel racks.

Lv o


72. During an electric~l "trouble" test in a test support facility, a technician receiv~d electrical burns on cot·h hands while handling a 480v, 3 phase cable and receptacle.

73. During routine onsite maintenance a technician was blowing corrosion from the top of a bank of electrical storage batteries with an air hose when the air stream entered a battery wall via a vent and blew caustic alkaline solution into his eyes.


Causes

Y.aterial failure in that the receptacle had an electrical short.

Inadequate maintenace procedures. The technician had :0 use unregulated air of 60 psi which created sufficient internal pressure in ·the battery to spray the solution out. Contributing was personnel error in that the technician was not wearing eye protection eqUipment.


Action

Require low vol'c9.ge continuity cHeck of high '/oltage cables/receptacles prior to applying load during maintena~ce or "trouble" testing.

Forbid the use of air over 15 psi pressure for battery corrosion cleaning. Supply pressure regulators for all air hoses used in battery maintenance operations. Ensure that eye protection equipment js available and its use enrorced at field sites as well as in shops.

W J-I


74. Seventeen of 27 nickelcadmium batteries in an unattended emergency lighting cabinet in a facility mechanical equipment room were ruptured, due to internal ol/:erpr~ssure or externally ignit-ed hydrogen explosion, resulting in blowing the door of'f' the cabinet and streWing pieces of plastiC cell case over the f'acility floor. It was evident that an explosion of considerable magnitude had occurred without smoke 01' soot depOSits.


Causes

The exact cause of the explosion is unknown. Probable cause was inadequate maintenance procedures/techniques which allowed a contaminated electrolyte chemical reaction to plug battery vent caps, permitting a hydrogen pressure ~uilduP. Another possible cause was deficient operating procedures which failed to recognize the possibility of an accumulation of hydrogen gas in a confined area which could be ignited by a spark.


Action

Ensure that facility maintenance personnel are instructed in the procedures/ techniques necessary to prevent contamination of battery electrolyte in emergency lighting systems. Require inspection of battery vent caps for plugging at each service interval. Require positive circulation of ambient air around battery areas in facility emergency lighting systems.

!

v-l f\)

75.

76.

Accident/InCident Description

In a test laboratory, tr.e wet cell battery of a wall mounted emergency light exploded, sending a spray of acid into a hallway, which at the time contained no people. No injuries.

During normal operations of an environmental simulation laboratory, outdoor swi tcn gear circuits triggered an explosion in their enclosure, resulting in extensive damage to the switch gear, transformer and electrical cables.


Causes

Maintenance had. inadvertently replaced vented battery caps with a non-vented type. During automatic "trickle charge" the battery could not vent the hydrogen produced and exploded.

Defective electrical cables provided an ignition source and triggered explosion of unexplained accumulation of gas in the area. Contributing was inadequate inspect.lon of electric cables and lack of a hazard analysis to determine potential gas accumulation in the syste~.


Action

Ensure that maintenance procedures for wet cell batteries preclude inadvertent substitution of non-vented caps. Ensure that personnel handling servicing and maintenance of wet cell batteries are trained.

Ensure that a hazard analysis is performed on any e~closed electrical control system for the possibility of gas accumulations. Establish preventive maintenance and inspection proced'.lres for checking condition of electrical power cabJ.es in switch gear installations.

w w

77.

78.


During operation of an electric bridge crane ~t a vehicle stage manufacturing facility, an electricaJ fire occurred at the plug-in unit serving the crane causing minor damage to the unit.

During routine maintenance in a test l~boratory, a technician attempted to close a circuit breaker, the "bat" llandle of which had broken off, by inserting the tip of a ball point pen into a hole in the remaining portion of handle for leverage. When the circuit breaker closed, a fl~sh occurred and the ball point pen diSintegrated.


Causes

Malfunction. !nadequat~ contact of spring lo~ded plug pins wl~h plug-in unit bue bar ca'lsed over-heating and fire. FO-.lr over-current protective devices failed to operate. Contributing were :nainten9.nce policies which did no~ ~all for periodic inspection/adjustment of contact mechanisms or over-current protective devices.

Ina1equate laboratory operation/maintenance procedures in that the defec'::ive switch handle had not been "red-tagged" to prevent operation. Contributing was personnel error in tr.at the technician attempted to manipulate defectIve electrical hardware.


Action

Establish maintenance ~~d calibr~tion/inBpection schedules for electrical plug-in units and overc,'rrent protective de7ices used on equipment ha-~dling end item hardware. Ensure that maintenance schedules require checking the adju~tment of electrical contact points ~d the time current characteristics of over-current protectl-ve devices.

Ensure that laboratory operating/maintenance procedures prOvide for timely "red-tagging" and reporting of defective laboratory electrical equipment, and prohibit use/0peration of such ha~dware until repair is made.

·····1

I

UJ +="


79. During routine facility maintenance of an automatic charger battery system, 6 of 27 nickelcadmium batteries being reinstalled exploded, resulting in mild chemical burns to two workmen.


Causes

Inadequate work procedures in that a probable cause was ignition of accumulated hydrogen gas by a spark generated during the replacement work, and inadequate ventilation of the battery area; a second probable cause was stopped up vent caps, resulting from contaminated electrolyte, which permitted hydrogen pressure build-up to an explosive force in the 6 batteries.


Action

Require positive circul~tion of ambient air around battery areas during maintenance/servicing of batteries. Require verification of battery vent cap openings prior to initiating maintenance/ servicing 1n battery areas. Ensure that maintenance personnel are adequately instructed in the procedures necessary to prevent contamination of battery electrolyte.

w V1

95.

96.


During inspection of facilities' fire detection systems at a NASA center, several "fixed temperature/ rate of rise" fire detectors were found defective in the "rat'e ofri.se" mode.

During welding operations of a launch facility structure on the upper level, slag fell to a lower level, striking a workman. No injury resulted, although the potential for such was present.

SECTION III FACILITY/aSE SYSTEMS

Causes

Material failure because a crack or other defect in the detector pressure tight dome prevents necessary pressure build-up from heat exposure which activates the alarm.

Failure to exercise reasonable safety precautions, in that protective devices were not used.


Action

Establish periodic 'inspection and replacement" schedules for automatic fire detection equipment at all facilities.

DeSignate all welding operations on launch facility structure as hazardous and require safety inspection prior to commenCing operations. Enforce use of protective measures to control sparks, spatter, and dr1pping slag during welding operations.

w C'\

97.


While undergoing contingency crew fire training under live fire conditions, 3 men received minor injuries when the portable extinguishers used malfunctioned and the trainees panicked and ran from the training area.

98. During heat curing of materials in a 5000 F. rated environmental chamber, the materials were decomposed and the chamber damaged due to an excessive rise (to approximately 1000° F.) in chamber temperature.

SECTION III FACILITY/GSE SYSTEMS

Causes

Failure to properly inspect and maintain extinguishers, since chemicals had formed and

. lodged in discharge hose, making extinguishers inoperative. Contributing were failure to familiar·ize trainees with escape routes prior to beginning operations and the use of a fire much larger than needed on a windy day.

Failure to follow approved procedures in that the temperature sensing and control system was improperly set when the chamber was readied for operations. Contributing were a material failure and a design deficiency; a chamber pressure bleed line had failed and the chamber temperature control system was so designed that it was dependent on proper operation of the chamber pressure system to provide over-temperat~re shutdown.


Action

Require ~ormal procedure~, for cleaning, inspection and maintenance of extingui~hers, including inspection for blocked discharge hoses. Require "dI-y-run" of trainees prior to exposure to simulated fire fighting conditions. Ensure that wind factors are considered when determining size of training fire to be used.

Require the use of formal procedures and checkists in preparing test chambers for operation. Ensure that test chamber temperature sensing and control systems. are independent of the proper operation of other systems, or provide failsafe features.

LU -...J


99. Approximately ten minutes after a welding crew at a test site construction operation had quit work for the day. '3. fire occurred as a result of hot slag wedged between a scaffold bO'3.rd and tarpaulin wind break.

100. During inspection '3.nd recovery of a sample in an X-ray spectrometer, a trained '3.nd qualified technician bypassed the safety interlocks and removed a shield to recover a spilled sample and was exposed to X-ray radiation.


Causes

Inadequate work control procedures in that an asbestos fire blanket was not in place during the welding operations. Oontributing was failure to inspect work area prior to leaving.

Failure to follow estatlished procedures for handling samples in the spectrometer. Contributing were a design deficiency in that the spectrometer lacked '3.dequate positive safety interlocks to ensure de-activation of the x-ray high voltage power source when the shield was removed, and a lack of hazardous condition warning devices.


Action

Ensure that work control procedures enforce use of barriers/asbestos blankets during welding operations; require at least a one hour fire watch following end of welding operations.

Require tha~ all x-ray spectrometry be deSignated as hazardous. Provide safety interlocks that will turn off the x-ray power supply when the shield is re~ moved. Ensure that all areas where x-ray eqUipment is being used are designated and placarded as hazardous.

lA) ():)


101. While cutting a steel plate near an unused LN tank, during manufagturing operations, sparks from the cutting torch fell on the tank insulation causing it to ignit~ and resulting in a small fire.

102. During the proof loadtesting of a manufacturer's 10 ton bridge crane, a control panel door loosened and fell 40 ft. to the floor.

103. While moving a work-stand being used during the assembly ,and checkout of a flight module, a handrail struck an antenna guard cover on an adjacent module causing minor damage to the cover.


Causes

Inadequate work control and failure to follOW established'procedures and safety precautions, in that operation was started l'rithout required approval of supervision and fire department verification.

Inadequate inspection/ maintenance procedures in that the holes for #4-counter sunk screws had enlarged and could no longer ho Id the door hinge in place.

Inadequate work control which permitted moving the work stand without assistance and assurance that,proper clearance from flight hardware articles could be maintained.


Action

Designate all welding operations around LN? tanks as hazardous. Require safety/fire department inspection and verification befor'e welding starts. Require use of protective shields or blanketing.

Require maintenance inspection of counter.sunk screws and screw holes for looseness or wear on overhea,d handling eqUipment being used with critical program hardware. Where possible, replace. screws with bolts and lock nuts.

Require the use of at least one observer to verify clearances during movement of workstands in program manufacturing! assembly areas.

W \0


104. During manufacturjng welding operations on an engine instrumentation line, a high frequency arc punched through the insulation of the welding head cable and burned a hole approximately 3/16 inch in diameter in the engine crossover duct bellows.

105. During maintenance of a space engine manufacturing facility air conditioning unit, a solenoid valve blew up while being sweated off a unit freon line, causing minor injury to two workmen.

SECTION III PACILITY/aSE SYSTEMS

Causes

Inadequate pre-welding inspection procedures, since inspection of the failed cable suggests several strands were cut or broken prior to initiation-of the arc. Contributing was personnel failure to maintain required cable clearances from conductive surfaces.

Personnel error. The freon line had not been cut, as required, to relieve gas pressure prior to applying heat.


ActIon

Require pre-welding QC inspection and certification of electriC arc welding cables prior to use on program essential equipment. Inspect for unacceptable insulation cuts, knicks and abrasions; prevent welding cables from touching conductive surfaces during welding. Ensur~ that welding personnel are t.rained and certified for safe conduct of the work.

DeSignate all welding, torch cutting and heat sweating operations on essential facility airconditioning o~ refrigerating equipment as ha-zardous and require training and certification of workmen for their Job. Require use of checklist procedures when such work is performed in vicinity of flight hardware.

~ '1

-+= o ..


106. During a m~~ufacturlng functional check of the ladder/catwalk assembly for horizontal tank in~erlor operations, the winch which deploys ~d stows the assembly fai~ed, allowing the assembly to drop uncontrollably to its deployed position. Damage consisted of ';:)roken cables and fittings on the assemcly. There were no injuries.

107. While a spacecraft was mounted on a workst~d during parts installation a VHF in-flight antenna was damaged in an unknown manner several hours after having been installed.

SECTION III FACILITY/aBE SYSTEMS

Causes

Inadequate tool inspe~tlon/ m~in~enance procedures in that the manually operated winch, which had a malfunctioning safety lock and a loose drive handle, had not teen removed from service. Contributing was inadequate work procedures which allowed use of defective equipment.

Inadequate work control in that there was failure to use available ~tenna protective devices.


Action

Require periodic(at least monthly) maintenance inspection of handling gear in manufacturing/assembly areas. Ensure that manufacturing/assembly area operating procedures require "red-tagging" of deficient handling gear, and removal from service \:ntll repair is made.

Ensure that area work procedures require installation of flight hardware protective devices during assembly operations, when they will not interfere with current work. Require formal QC inspection and, verification of their installation.

+=" I-'

108.

109.

..


During first stage engine boost test of a spacecraft test article~ the vehicle was damaged due to failure of a bolt in a load adapter. Failure occurred at approximately 139% of a scheduled maximum load of l4~.

During preparations to introduce a powdered chlorine compound (HTH) into drinking fountain drains, in an assembly and checkout facility, the compound ignited, releasing dense clouds of chlorine gas.until extinguished with a C02 fire extinguisher. Personnel were evacuated with no injuries.


Causes

Inadequate work control in assembly of the test set-up in that the failed bolt had been overstressed in a

. previous unrelated test and was incorrect size for the boost test.

Failure to instruct maintenance crews about the combustion and toxicity hazards of HTH. The crew used a plastic bottle apparently cont~inated with some foreign material that ignited on contact with the HTH.


Action

Establish supervisory/QC controls to prohibit reuse of test set-up hardware unacceptably damaged or overstressed during previous tests. Require QC inspection and buy-off of test set-up assemblies for conformance to test set-up drawings prior to initiation of test on program essential equipment.

Ensure that all maintenance personnel are informed of the hazards and precautions in using HTH. Require hazard warnings on HTH containers. Require that containers used with HTH are washed immediately prior to use.


110. ~~en the doors on a flight vehicle assembly building were closed, three float 8c~ffolds erected earlier were caught i!1 the path of the clos1ng doors and destroyed.

Ill. During :'llnctional test at a space vehicle assembly facill ty, a helium manifold controller was left inside a vacuum drying oven over the weekend a.."1d was badly charred, requiring extensive overhaul.

~ I\)


Causes

Personnel error in ~~r.at

verif1cation of adequate door clearances was not made before closing. Contr1buting was failure by riggers to place requ1red flags or signs to warn that scaffolds protruded into the door's pa~h.

Malfunction of the over power s-..lpply switch relay "Tliich kept oven power on after the over. pilot switch was turned off. Contributing were inadequate power shutdown proced~res in that the facility m·ain power supply switch was left on, and inadequate maintenance procedures in that the oven switch relay had a design life of one million cycles but was cycled 1.8 million times before it failed.


Action

Eneure that obstructions near sliding doors have warning flags or eigne when they protrude into clearance waye.

Require +:ha"~ proced~"es gove!'Tling ove'1 dry~-nE; of program critical ~ardware include shut down o~ facili~y main. power ~\:ppl;: circuit as well as unit pow~r swi~ch at -end of daily operations. Ens1'.re that maintenance schecr~les which specify "[".>r1acernent of parts before end of design life are prepared and followed for all eqt~ipment which handles pro~r~~ cr.itical hardl'la;1:'"e.

..j::

VJ

•


112. During preparation of a pneumatic test chamber for a high pressure impact test at 9500 psig the sequencing valve was being cycled whef\ an explosion and GOX fire occurred, destroying miscellaneous chamber equipment. There were no personnel injuries.

113. During test of a flight experiment package in a thermal vacuum chamber, the package and associated equipment we:re severly damaged by internal high voltage corona discharges which occurred when a chamber vacuum pump seal failed and allowed chamber repressurizatlon.


Causes

Material incompatibility in that the non-metallic material (Vespel 21) used for a valve seat reacted with the high pressure oxygen to cause the explosion.

Deficient test procedures in that the adequacy of the test setup was not veriried prior to or during the test; loss of seal was caused by improper positioning of a ran used to blow air on a LN2 trap-.input solenoid valve to preven~ ice build-up on the valve and subsequ'ent loss or seal to the atmosphere. Contributing was deficient test setup design in that there was no provision for automatic cutoff of high voltage sources in event of pressure rise in the chamber.


Action

Prohibit use of Vespel 21 mat~rial in applications using high pressUI'e oxygen. Require safety review/ analysis or oxygen system/ component designs and specifications during their development to eliminate materials incompatibil1ty.

Require use of formal procedures and checklists to obtain and veriry proper configuration of test setup in test chambers; include periodic inspection of test

system elements for proper operation during the test run. When conducting vacuum tes~s on a specimen having a high voltage source that is likely to arc in the corona pressure range, require installation of an automatic power interrupter ~o shut off the high voltage source on significant rise in chamber pressure.

114.

115.

-'==' -'=='


During manufacturing assembly of ~ spacecraft module a drain bucket used to bleed a water glycol trim unit was entangled with an .intercom extension corj .in the module and tlppe.d over, spilling water-~lyco I solution. There was no damage but the incident could have caused module contamin~tion.

While cutting a structural member on a launch support facility, molten slag fell on flight equipment and lines at


Causes

Inadequate work control ~n that the unattended drain bucket had not been secured, and area ho~sekeeping was marginal.

Inadequate work control in that welding operations were being performed without providing protective sh1elds, covers, or blankets.

lower level dam3.ging fluid lines and burning electrical cabl.es. Subsequent investigation showed th~t the torch was be1ng used only 3 inches from unprotected fuel lines and a 3000 psi helium supply line. There were no injuries.


Action

Implement and maIntain rigid housekeeping controls in flight system assem1::ly areas. Require per:1.odlc QC inspection during each shift.. Prohibit unattended liquid containers in work areas unless secured from inadvertent spill by ~ holding fixture.

DeSignate all welding operations around flight hardware as safety critical. Require inspection and safety apPiroval prior to welding operations. Require protective blankets or covers to prevent damage from falling welding slag.

~

\11

116.

117.


While lowering an engine service platform lit a launcr. vehicle assembly station with four hand-operated winches, one of the winches' failed at the cable drum swage connection, allowing one side of the platform to fall, striking and slightly damaging one engine.

While movi~g an engine vertical installer from the first level of a teststand at a test facility, the left and right horizontal adjustment hand wheel struck. the concrete structure of the stand, resulting in breaking of 2 spokes at hub with an additional check of one

. spoke at the outer ring.


Causes

Inadequate work control in that the failed winch was positioned so that only 3 cable turns remained on ';he drum at the time of failure; and the lowering method used could allow uneven distribution of the load (overload). CC'ntributlng was operator error in not requiring a halt in operations as the cable was paid out to the 3 turn conoitlon.

Inadequate work procedure since there was a lack of attention given to the clearance needed between the installer and the test stand as the move was being made.


Action

Ensure that winches are so positioned in work areas that at least 3 cable turns will remain on the winch drum at maximum cable extension. Where pose1ble avoid use of independently operated winches on the same load; use adjustable Single point pickup tool to livoid uneven distribution. Ensure that handling personnel are instructed and certified for safe use of hOisting equipment. Require the use of at least one observer during movement of heavy equipment in test areas. Ensure that operators are pr~perly certified for duties being performed.

118.

119.

120.

~ 0'1


Du.rir .. g lowering of an electrical ~able by a me'chanic from an upper level of a mobile service structure to pad level, a cable coil lying on the 1eck caught his foot, ja~~lng ~i3 leg against the railing, resulting in minor injury.

During high winds, (tornado action) two trailers in a launch pad area were overturned and destroyed. There were no injuries.

While checking inoperative elevator doors in a launch f'3.cill~y Str'.lCture, a workman'S finger was. caught between the linkage and hangers when the elevator was activated. The finger was severely lacerated.

.'


Causes

Failure to exercise reaso~lable safety precautions in that the he,avy cable was not properly sec~red to help control the lowering operations. Contributing was failure to provide suf~icient personnel to safel'l lower the cable.

EnVironmental, trailers were torn loose from tie downs by tornado action winds.

Inadequate work cO:1trol in that the doors were being checked with the elevator power on.


Action

Require s;:).fety secur1ng of all portable equipme:it when it is being raised or lowered. Ensure tr.a,; suffiCient ?arsonnel are assigned to safely handle raising and lowerIng of portable apparatus.

Req~ire that ~afety standards and pr~c!lut.ionar~r neasures be established for protection of tigh value trailers in areas subject to high winds.

When working on e le'Tator systems ensure that the elevator power source is turned orf and ei '.;her locked out or guarded by a co-worker.

+=" -..:]


121. D~ring inspection of a stage pressure regulator the :nspector dropped it and it fell 4 feet to the floor, requiring component return to the vendor for reinspection and retest.

122. During installation of ~ servoactuator on a spacecraft engine, a certified position and holding fixture (P&HF) failed, permitting the free end of the servoactuator to rotate and fall 3 feet, striking two technicians and a steel work bench, resulting in minor injuries to the technicians and minor damage to the servoactuator.


Causes

Inadequate inspection procedures in that positive component protec~ion was not provided during inspection. A contributing cause was failure to exercise reasonable safety precautions during component handling.

Design deficiency in that the P&HF wae in a failed condition prior to use but the design configuration did not permit ready inspection of the failed item (a shoulder screw); and the failed condition may have been induced by a standard proof load test (150% of safe working load). Contributing was poor workmanship ~uring P&HF fahrication.


Action

Ensure that inspec~ion procedures Y"~quire po~itive positioning and protection of critical eqUipment during inspection activities.

Ensure that GSE fixtures which handle end-item hardware are designed 80 that c.ri tical wear point 8 can be readily inspected prior to use, and can be subjected to rigid QC inspection during fabrication. Require handl1ng/l1""ting equipment to be designed with a minimum safety factor of 5, and ensure that any components subject to repeated load stresses can be easily inspected for fatigue.

+=' co

A.cc1dent/Inc1dent Description

123. A laboratory technician in a materials test facility was exposed to x-ray radiation due to failure of a safety device (lead shield) on a diffraction unit which became jammed in the open position.

124. During material curing operations at a test facility, a technician reached in the oven and received second degree burns. I

.: "

SECTION III FA.CILITY/GSE SYSTEMS

Causes

Inadequate x-ray diffraction unit design in that the lead shieldwas internal to the unit ~nd its open/close status WaS not sufficiently visible external to the unit. Contributing was inadequate procurement/receiving inspection and checko~t in that the design deficiency was not detected prior to or at the time of installation.

Personnel error in reaching into hot oven. Contribu't;·ing Was failure to provide proper tools for reaching in the oven.


Action

Require positive indication/ warning of position status of shields used in x-ray units or systems. Require pre-procureme,nt radiation safety review of units deSign to verify adequacy of controls. Require radiation safety inspection/checkout of safety controls operability prior to~erational activation.

Ensure that all personnel working with curing chambers are properly trained and certif1ed. Ensure that specific instructions are issued specifying tools to be used and procedures to be followed in curing operations.

-+=" \,()

•

125.

126.

,I

Aocident/lncident Description

During test build-up in a thermochemical test facility, insulation on an electrical immersion type heater caught fire due to failure of gaseous nitrogen flow over the heaters, and subsequent erroneous positioning of the heater control SWitch.

During maintenance operations requiring exchange of two operational mass spectrometers for'malfunctioning ones Situated on upper levels of ~ checkout facility, three units were placed into the hOisting basket at one time and, as one of the units was being off1oaded, it swung over and collided with another, damaging two gages.


Causes

Inadequate heating system design in that the heaters were dependent on nitrogen gas flow to keep them from overheating and there were no interlocks to automatically shut down the heaters in case of gas flow failure. Also, no heater case temperature gages to indicate overtemperature conditions; grouping and labeling of heaters' control switches in such a manner that erroneous identification of their positions could be, and was, made.

Inadequate work control procedures in placing more than one instrument at a time in a Sling and failure to properly proteot instruments prior to movement.


Aotion

Require positive switch cutouts for control of gas flow dependent heaters, to aotivate in ev.ent of low gas flow. Require temperature readouts for each heater case used in test systems. Require separate positive indicating off-on switches for eaoh heater ul!ed in test systems.

Require that only one high value/fragile test instrument or similar hardware item be hoisted at a time. Requir~ QC verifioation of proper . hardware protection and padding prior to hoisting high value/critical program hardware.

\J1 o


127. During spacecraft assembl~r testing, a ground-support module cooling unit lost its capability to supply water-glycol cooling, necessitating test shut down and a four hour delay in operations. There was no damage to spacecraft component s •

129. During clean room operatIons three technicians became ill from inhalation of freon fumes shortly after turning on the freon cleaning unit master switch at the start of the second shift. They were unaware that the freon pump switch had been left on by first shift personnel.


Causes

Personnel error. Failure to follow proper mainten~nce procedures in that the cooling unit had been only partially refilled with freon during ser"Jicing.

Inadequate work control procedures for coordinating information between shift changes beco:tuse the freon cleaning unit was shut down at the end of the first shift by switching the master switch off and leaving the discharge hose on the floor with the pump switch on; thi.a condition was not transmitted to second shift personnel. Contributing was that the clean room had laminar down. flow into subflooring so that discharge of freo~ from the hose was not readily detectable.


Action

Require thorough postservicing/main~enance test and functional checl{out of all GSE environmental control equipment used in essential operations prior to peturning to operations.

Require use of shift-change checklists in clean room operations to transmit essential information on status and conditio~ of test and operating equipJlent.

\J1 I-' I


"

129. While the system was operating, the water separator bowl on an industrial air system facility exploded. There were no injuries.

130. During flight readiness test of a manned s;)Tstem the launch structure was struck by lightning, causing minor damage to automatic checkout equipment.

131. During manufacturing operations a non-stainless steel reducer in a cleaning tank air line failed resulting in a 30-40 gallon nitric acid spill. There was minor damage to tank plumbing and the . cleaning room. floor.

. SECTION III FACILITY/aSE SYSTEMS

Causes

Material failure in that a crack in the bowl was undetected and constant press~re caused it to enlarge until failure occurred.

Environmental in that apparently the lightning strike ~raveled through the ground to the checkout eqUipment. There was no evidence of inadequate grounding or safety procedures.

Unqualified workmen erroneously installed the air line directly into the side instead of over the top of the tank,allowing acid to corrode the st·~el reducer. Contributing was fa.ilure to inspect work for conformance with approved work drawings prior to use.


Action

Ensure that inspection prccedures provide for periodic checks of water separator bowls in industrial air systems.

Require post-strike/electrical storm checks for damage to essential equipment. Ensure periodic inspection and continuity checks of the grounc.ing of lightning protection systems.

Ensure that personnel involved with insta.llatio~maintenance of hazardous assemblies are specifically certified for their job. Require QC verification or all installation work involving hazardous materials and critical hardware.

\J1 1'1)


132. D~ring pull test o~ ~n item of ground test support equip~ent use1 in de~elopment testing, ~ component of the ~est article was broken due to excess pull force applied by use of a facility overhead cr~~e. There were ~0 personnel injuries.

133. During facility modifications, a contractor performed inspection usi~g a gamma raY source without first securing approval of the radiological safety officer, and wi~hout instituting adequate area control and warning procedures. There were no accidents or incidents.


C~uses

Inadequate/deficient test oroccdures in ';hat th~ use of the overhead crane waS suostituted for a malfunctioning hydro set tool aEsigned for pull test use, to expedite test operations.

Management failure to establish and implement policy to include radiological health procedure requirements in facility contracts goverRing radiographic inspection.


Action

Prohibi'c ~lse of substitute test tools and fixtures for test of essential equipment unless certainty is established that safe test parameters will not be exceeded by use of such substitutes.

Require the inclusion of radiologic.al safety and health requirements in safety and .health clauses, and other pertinent clauses, of facility contacts where radiographic equipment is used.

\..11 W

134.

135.


During post-assembly test of a spacecraft oxygen system, while a cap was being torqued on an oxygen simulator panel, the back-up wrench elipp~d off an elbow fitting resulting in da:m3.ge to and repl3.cement of an adjacent line.

During manufacturing , checkcut a "tift-ALoft" being oper3.ted ::td-

jacent to a vehicle stage made contact with the stage causing two gouges, one 1" xlI" and the other approximately 1" square 91ld 3/4" deep.


Causes

Deficient Simulator panel design in that insufficent clear space was provided around t:le eluow to allow a secure grip with assigned tools. Contributi~g was personnel error in not taking 'adequate precautions to pro-tect -adjacent hardware during torquing operations.

Inadequate work control in that verification of clearances W3:8 not made prior to vehicle movement.


Action

Require maintainability review/analysis during design of test equipment, to verify design compatibility witb standard cools or to identify special tool reqUirement.s. Ensure that maintenance/test personnel are adequately trained and instructed in the precaution3 necessa~J to protect essential equipmp.nt juring maintenance/adjust~e~t operations.

Requir·~ an observer to assist in verifying clearances to operator when using handling/lifting equipment around flight hardware.

! .1

:'"Hnt

,1 ,

\Jl +:-

ACCident/Incident De sc~ipt ion

136. While on portable scaffolding in an

137.

assembly and checkout facility, a technician using a safety belt tethered to a trolley installed in an over-head channel inadvertently· dislodged the trolle:>, stop, allowing the trolley to fallon him, causing minor head injury.

During use of a prepositioned TV set-up, a remotely controlled flood light was activated whilp. lying face down and ignited a tar paper roof near the LOX pad. The light was disconnected and the fire was extinguished with minor damage to the roof.


Causes

Personnel error. The workman, by repeated yanking on the harness, forced the trolley beyond the stop. Contributing was ,1esign deficiency since the stop should have been immovable when struck by the trolley.

Inadequate work control since the light was left connected to the remotely controlled power source after its pedestal had been removed for maintenance.


Action

Ensure that the design of ~ll trolley etops will prevent inadvert'ent trolley dislodgement. Ensure that worlonen are inetructed on any limitations on equipment being used.

Prohibit the use of electrical lamps near flammable materials unless equipped with adequl1te safety devices. Require safety inspection and cert1fication of all high intensity and heat lamps installed nel1r LOX, fuel, or ordnance areas. Ensure that maintenance procedures require positive disconnecting of all electrical equipment prior to beginning maintenance work.


138. During painting of a static test tower at the 150 ft. level, a contractor painter was using a boatswain's chair and associated rigging for support. While the painter was being hoisted in the boatswain's chair, a manila rope in the block-and-tackle broke causing the painter to fallout of the chair and sustain fatal injuries.

139. During operational test of a spacecraft, a water glycol cooling circulation unit lost electrical power, resulting in test s~ut down for 29 minute •• There was no damage to spacecraft components.

\Jl \J1


Causes

Material failure In that the rigging rope failed. Contributing causes were inadequate work control over contr~ctor activities and failure to require inspection, and certification of the contractor'e rigging prior to use, and failure of the contractor to use required safety restraints.

Inadequate design in that a 28 VDC cable plug dropped out of the facil~ty receptacle causing the shut down.


Action

Require safety inspection and tagging of all rope rigging lines to be used for personnel prior to each use, whether contractor or government owned.

Require that power and control circuitry on critical test support equipment connectors be equipped with positive retentionl restraining devices.

'l

\J1 C".


140. While a block-andtackle rigging in ~n assembly and checkout facility was being used to lift a bundle of test cables, the snap hook sliding bar failed, allowing the block and tackle to fall, striking a hard-hat-wearing workman on the head, causing minor injury.

141. During flush line servicing, trichlorethylene (TRIC) vented into a mobile launcher work compartment, necessitating personnel evacuation. No damage or injury.


Causes

Inadequate work control procedures in that lifting operations commenced without a QC or safety validation of rigging proof loading! capacity.

Material failure in that a valve failed in the mobile flush and purge servicer, allowing TRIC to leak.


Action

Require inspection and validation of special rigging setups prior to use. Ensure that all workmen using or rigging lifting gear are qualified and certified for their job.

DeSignate all TRIC flushing operations as hazardous. Perform hazard analysis of all flush line servicing operations to identify potential personnel hazards and emergency actions in ca~~ of TPIC vapor release.

\J1 -..J •


142. During checkout work on

143.

a spacecraft, a cast aluminum support fi~ting on a scaffold failed while a technician was climbing up. There Wel'e no injuries.

DurIng furnace brazing an R&D engine injector was destroyed when the furnace temperature increased from the normal 19000 F. to 2400° F. and melted copper parts of the injector. There was also moderate structu~al damage to the furnace.


Causes

Material failure in that the support fitting broke under normal service conditions as a result of fatigue.


Action

Require periodic safety inspection by supervision of scaffold fittings and supports to detect signs of inCipient failure, such as thread cracks.

~lfunction of the temperature Ensure QC inspection of control thermocouple circuit all electrical circuit which gave an erroneously low installation and maintenance temperature reading due to an in electrical furnaces to electrical short circuit be used with critical Re:D between the temperature re- and end item 11ardware prior cording instrument inner ~oor to use. Eneure furnace and wire of the thermocouple brazing and heating specifi-filter circuit. Contributing cations and procedures were faulty installation pro- require monitoring of cedures and poor QC inspection fUrnace temperature as well which led to the short circ:.tit- as item temperature on all ing, and inadequate design furnaces used with program which did not allow for monitoring essential hardware. furnace temperature along with the temperature of the item being heated.

i

\J1 co


144. During torch cutting operations in a launch facility, molten slag fell to a lower le-J'el, igniting plastic film being used in conj~n~tionwith a drain setun. The fire caused only mir.or damage and no injuries.

145. During work on an upper level of a mobile launcher, a hold down arm hood pivot bolt, which was being removed, was forced out and fell to ground level. No injury or damage resulted, ~ut a similar mishap could cause severe injury or damage to flight hard~are.


Causes

Failure tc follow required procedures in that blanketing of the area around the cutting operation was inadequate and permitted hot slag to fallon the plastic film; and the cutting operation was undertaken without prior safety ~learance.

Failure to follow required procedures in that ~he pivot bolts were removed without a sling and crane being attached to the hood to relieve pressure.


Action

Ensure that all welding operations in a launch facility are s~fety inspected prior to beginning work. Require safety training and certification of welders for work in haz$lrdous areas.

Ensure that procedures ~d/or checklists are followed during all work on flight systems and support structures. Whereever pOSSible, provide safety netting around upper level operations.

\Jl \0 .

Acc1dent/Inc1dent Description

146. Several ordnance-activated vent valves received minor d~age when loose packing material in the store room caught rire from sparks of welding operations in an adjacent room. There was severe damage to storage area. No injuries.

147. During assembly of a multiple adapter unit, a rivet bucking bar was dropped and impacted a coaxial cable connected to a switch box, pulling the catle out of its connector on the switch. There was minor damage to the connector.


Causes

Inadequate work control of welding operations in failing to inspect for nearby combustibles. COintributing cause was housekeeping policy which permitted storing flammables near ordnance items.

Inadequate work control in that program essential equip-ment wa~ not protected . from inadvertent damage during assembly operations.


Action

Designate all welding operations as hazardous. Require pre-operational area inspection and safety clearance, and the use of a spark barricadejblanket for all welding operations. Enforce housekeeping policies which prohibit storing combustibles with ordnance items.

Require protect i..,re covers over prograrr. eqUipment when work is .being performed adjacent to or above the items. Require that all hand tools be restrained when being used above eSSential equipment. Require screens or netting around work platform areas located above essential equipment.

0'1 o

148.

149.


During hgndli~g o~~r~tlons. a &llde wire cabl~ d~~ wa~ ~carred and bent when ~ locking pin lodged in the locking frame.

While the high rise elevator at a launch and checkout facil1ty was in operation, bolts on the stabilizer car failed, allowing pieces to fall to lower levels.

150. During assembly operations in a clean room, a fan being used to circulate air into a unit of flight 113rciware caught fire, due to an electrical short resul~ing from previous impact damage to the motor hous1ng.


Causes

Failure to follow required procedures in that the drum was put into motion while the locking pin was being removed. Failure to coordinate simultaneous operations.

Material failure in that two of four bolts fa1led, probal:lly due to metal fatigue. Contributing was failure to perform daily inspection of bo'lts when normal 5 day work week was extended to 7 days.

Procedural in that existing mishap reporting procedures did not require reporting of the mishap which damaged the motor housing. Contributing was a design deficiency in that the fan did not have an .overheat protection de'rice.


Action

Where possible require all cable drums with safety lock mechaniems to be plac3rded with warning notices to prevent operation prior to releaSing the l~ck.

Eneure that faci11ty "d~ily" inspection orocedur~s are carried out when normal work week is extenden.

R.equire that all electrical aSE/facility motors used during assembly of fligr.~ hardware be equipped wit:, overheat protection devices. :Sstablish procedures for i~~edlately reporting and documei1+-,ing all nishaps and corrective actio~s which imrolve any damage to aSE/facility equipm,,!:-,t used during assembly of flight hardware.

. 0'0

......


151. A technIcian was opening a one pound can of finishing compound at a test facility when the lid blew off and the compound blew out into the air.

152. D'..tring assembly of a flight system module a wo~knan fell from ~ pl~tform.receiving minor inj'J.ries.


Causes

Material failure in that the compound had chemically decomposed from old age and formed a 33.S whIc~ created sufficient pressur~ to blow orf the lid of the can when it was partially loosened.

l'he priml.ry cause was th~t super"Jisory personnel allowed workmen ~o use an unst~=le pll.tform. Contributing were failure to make a temporary fix with rope, ~ two-month delay in fulfilling a repair work order. and a nor.-approved structural change in the platform.


Action

Develop a program '~:l ::'c1entify all materials subject to hazardous decomposition and est~blish procernlres for their routine removal ~rom stock ~~rore critical age is reache1.

DeSignate work on overhead platforms as hazardous. Ensure that supervisors prevent use of unsafe work platforms. Require prior approval and post-change safety inspection of all st~J.ctural modifications. Establish procedures to expedite repair of hazardous personnel support structures •

::-~ ~ f\j

Accident/Incident __ De_s?.2:1 pt iC!~

153. While performing c:!.rc-_d~ etching operations j'.:.!"~ng m3.nufacturing, Ci.

technician Vi3.S exposed to toxic fumes.


Causes

InadP.quate capacity of tr.e exh~ust system which did not 3.dequately carry aw3.y fumes. Contributing W3.S failure to check and monitor system for toxic fumes.

154. During modification wo'!"'k on Personnel error due to poor an elevator in a launch stru~work area practices ~d pro-ture, a mechanic apnarently inadvertently activat~d 3.

~ortable elevator contr~l switch, moving the ele'''3.~or downward and trapning hi~ arm between elevato!' 3.!:.d shaft 8tI'1.lctur~, resul+:in-; in serious injury a~d ~u~sequent amputation of the 3.rm.

cedures by placing ewitch where it could be inadvertently activated. Contributing was design deficiency in that the portable switch could be inadvertently struck by some object or stepped on thereby activating the elevator movement.


Action -----Ensure t:hat all op-=ratlonl:' in-ITolving +;oxic fumes have teen checked and certified for sarety. Require all exhaust systems to be safety verified for adequ3.cy.

Require that elevator portable control switches be deSigned to preclude inadvertent switching. Ensure that elevator mech~~ics are properly trained on methods and procedures required to maintain a safe work area.

O't VJ


155. During routine test work at a laboratory work table configured with an RF induction heater, a rese"3.rch ~ssistant received electrical shock resulting in arm burn~, due to contact with an exposed RF outlet.

156. Following operational checkout of an electromagnetic interference (EMI) test set-up in an RF anechoic chamber, a fire occurred in the RF absorber, resulting in minor damage to the absorber.


Causes

Inadequate design of warning devices in that although ~ blinking red light was activated when the RF power was on, it was so located that the ~echnician could, and did, fail to notice it. Contributing was ~nadequate shielding on the RF outlet.

Design deficiency in that the RF absorber was not grounded, permitting arCing between the RF coax cable and the absorber when the cable was in cloeeproximity to the absorber.


Action

Require safety review/ verification of laboratory warning systems and RF power outlet,S for adequacy and compatibility with laborator"J operations."

Establish a standard for EMI test set-up in an RF anechoic chamber, including a requirement for minimum one foot separation between absorber and cable. When RF cables carry more than 10 volts, additional grounding, adequate to prevent cable jacket RF voltage build-up must be provided.

()'\

+="

_. t __,I j • "-,_ 1111


157. During development testing, the sight gage of a steam generator on a laborato~J autoclave sterilization unit

, fa.iled, re leasing steam and water. ~n e'nployee attempting to clear the area, received minor injury when r.e slipped and fell. Only the gage was damaged.

158. During post operational testing, personnel i~ a facility laborato~J were exposed to toxic Eetapropiolactone (B-P) vapors emanating from a broken 1 Kg. tottle of crystallized E-P stored in a cabinet. B-? waS not used in the lab ~1 lab tec.hnicians had !"'.o knowledge that it was present or how it had gotten there. No serious injury resulted.


Causes

Inadequate inspection/ checkout procedures in that the unit had been damaged during shipmen~ and there was no record that the unit had been inspected and checked out at the time of activation (:;.pproximately 1 month prior to the mishap. )

Inadequate work control in that the B-P appare~tly had been stored in the cabinet ~ long time without having been disco-Jered or inventoried. Contributing was inadequate storage procedures in that B-P should be stored at+ 5" to+ 10· C.


Action

Require formal inspection and verifica.tion of press.ure uni t,s damaged in shipment prior to operational activation.

Require, as a minimum, quarterly safety inspections of laboratories to ensure that any hazardous chemicals or conditions are identified. Irnpl~ment formal proced~res for requisitioning and control of hazardous chemicals in laboratories.

0"1 \11

Accident/Incident _DescrJ~tion

159. Dur~ng manufacturing operations, a worker who was standing on the catwalk of a space vehicle support fixture, fell through a 12 11.-14" access opening between the end of the h~ndraii and end of the catwalk and landed on the vehicle. The worker sust:l.ineda concussion :l.nd other injuries. There was no damage to the vehicle.

160. After working hours, :l. f1re occurred 1n :l. warehouse due to ignition of oil-saturated cardboard boxes by radiated heat from a heat sealer. destroying 20 pieces of electronic eq~1pment and causing first and second degree burns to a night watchman who attempted to extingu1sh the fire.


Causes

Inadequ~te work area procedures in that there was no protective barrier or warning placard at the open1ng to prevent personnel from In:l.dvertently falling through.

Inadequate work control in that an electrical heat sealing device located :l.mong the cardboard boxes was left on at the end of the working day. Contributing was inadequate housekeeping of the packing area in th:l.t flammable material was stored in the packing area.

Recommended Preventiv~Corrective

Action

Ensure that work pro-cedures require safetl inspection of catw~lksl workstands at cumpletion of initial assembly and when changing their configuration to verify the adequacy of barriers and warning placards.

Require procedures/checklists for supervisory inspection of packaging areas fo~ hazards at end of work sM ft. Develop procedures and checklists for identification of flammable materials and store them in areas sep~:l.te from packing oper~tlons.

0'\ 0'\

Accident/Incident De script ion

161. During maintenance operations a technician was disconnecting a mercury-filled vacuum gage from a hypobaric test chamber when the gage broke, causing mercury to splash on his face and into his eyes.

162. ~ring equipment maintenance in a thermochemical test laboratory. chilled Freon 22 splashed on a technician from an uncapped line he had previously disconnected, causing extensive first degree burns.

l~3. During install~tion of a large vacuum testing chamber, workmen using a cutting torch dropped slag onto freon line insulation, starting a fire.


Causes

Personnel erro~. The technician bumped the gage with sufficient force to break it while attempting to remove a flexible CO'!1nection which attached the gage to the chamber.

Inadequate procedures in that the technician did not install a cap on the open tube to prevent the liquid Freon 22 from escaping when the pressure built up due to gas P3.porization.

Procedural in ~hat no asbesto e fire blanket was used and no fire watch set~ Also, the required "Hazardous Operation Work Permit" had not been obtained.


Action

Instruct and certify technicians in proper procedures for protecting delicate/hazardous instruments :'luring maintenance operations. Whenever possible, replace mercury-filled gages with a satisf~ctory mercury-free suhsti t,.te, such as a capacitance manometer.

E~sure work procedures require that the open ends of all fluid/gas lines be capped during maintenance/ modification operations.

DeSignate all welding and cutting torch operations as hazardous. Require safety inspection and verification prior to beginning all such operations. Stress the necessity for supervisory personnel to closely monitor welding and cutting operations.

0"1 ~


164. Following testing operations in a laboratory, a nitrogen valve in a mass spectrometer was left on resulting in split water lines and damage to the facility floor.

165. During m~intenance welding and cutting operations in a flight simulation laboratory hot sl'iLg fell on an air duct and ignited the insulation,resultlng in minor darnage~


Causes

Inadequate work control in that the nitrogen valve was not shut off at the end of the day.

Procedural in that no asbestos fire blanket was us~d. Also, the required "Hazardous Operation Work Permit" had not been obtained.


Action

Develop checklists for daily activation and shutdown of labor'iLtories and ensure their use by all laboratory personnel.

DeSignate all welding and cutting torch operations as hazardous. Req~ire safety inspection and verification prior to beginning all such operations~ Stress the necessity for supervisory personnel to monitor welding/cutting operations.


166. During crew training in ast~onaut rescue procedures, the test subject suffered a back injury while b8ing removed from the test ctamber.

167. While performing routine mai::1t;enar.ce

. "t'"r on the rail of a 'nonrail hoist near the ceiling of a hypobaric ch~ber, a workM~n received a severe elec~rical shock when his hand came in contact

·""'4'

0\ UJ .

"r ~.

. with the 480 VAC bus bar channel in the rail. He fell off the hoist but Was caught by other workers.

..


Causes

:!:::1adeauate work control. The trainees were allowed to p~ll the test ~lbject from the chamber While the bulk. of h~.s weight was still suspended from an o'!erhead rail. Possibly conl~r::'buting was failure to repor~ a previous similar injury which may ~ave left test subject's ba~kin a weakE"ned condi::ion.

Ir.adequate work control. The workman used the hoist as a work platform instead of using a ladder or portable scaffolding, and also was not using a safety harness.


Action

Ens'l;.re close supervisio:: of "escue training procedure~ by qualified p~rsc:1r.el. Require periodic meji~c.l ex~.!ninl'l.tion and qu~lification of 3.'.1 research and traini::1g test subjects.

Establish positive work control procedures to ensure the briefing of viorkers on job requirements, restrictions and potential tazards. Require the use of safety oelts for all overhead werk where there are no railings or other positive safety restraints. Require electrical power to be shut off and locked o~t on hoisting eqUipment when not in use.

0'1 \0 •

Accident/Incident Descriptien

168. While relocating a werk platferm during spacecraft manufacturing eperations, a welding machine on tep ef the platform fell to the fleor resulting in extensive d~~ge to the m~chine. There was no personnel injury or damage to flight hardware.

169. During post assembly flushing and drying ef spacecraft plumbing, the flushing cart pump motor overheated and caught fire, resulting in ,damage to, the moter.

170. During assembly inspection,of a stage from an upper level work pl~tform, a werkman drepped a 110 VAC portable work l~ght onto, the stage forward bulkhead pretective cover. The cover prevented any 'flight hardware damage.


Causes

Personnel errer in that there was failure to secure the welding machine in accordance with established procedures. Contributing was in~dequate werk centrel precedures in that there was no requirement to verify the safe configuration of the platform ~ea prior to movement.

Inadequate design since the moter was not equipp~d with a thermal overload pretection device.

Inadequat~ werk control in that the work light was not ,tethered. Contributing was personnel error in that the employee failed to exercise adequate precautiens when working on flight hardware.


Action

Require safety inspection and verification that teols and eqUipment en werk platforms are remeved er secure prior to, platform movement.

Require that all GSE/facility equipment metors used during assembly/test of flight hardware have therm~l overload protectien devices installed.

Require tethering of equipment/teols used en werk platferms above flight hardware. Require that personnel werking above and areund flight hardware be certified and instructed in werk procedures to prevent toel/ hardware droppage.

......::J o


171. During manufacturing assembly of a flight module, a cle'lis pin fell from an upper work level into an uncovered section of the module and did minor damage to installed equipment.

172. During the installation of a kick plate on a work platform in a stage manufacturing area, the stage sidewall insulation was struck by the kick plate resulting in indentation in the spray foam apprOXimately 411 long by!" wide. Stage move was delayed I! hours •


Causes

Inadequate work control in that there was no protective barrier in place to catch the falling clevis pin. Contributing was personnel

. error in that an employee at the upper level failed to exereise adequate precaution when working on flight hardware.

Failure to exercise adequate supervision and maintain proper work control.

Reconunended Preventive/Correct1ve

Action

Require installation of barriers and/or cat.ch nets when work is being performed above flight hardware. Require that personnel l'lorking above and around flight hardWare be instructed and certified in work procedures to prevent tool/hardware droppage.

Require that personnel working around flight hardware be instructed and certified in work procedures to prevent flight systems dam.age. I'/here possible, install removable work platform items prior to positioning platform at work station.

.~~ \'~;." ~

-oJ ..... •


173. *During structural modifications on top level of a mobile service tower, molten slag from a cutting torch became imbedded in the s~rofow sandWich wall o.f the environmental enclosure causing delayed ignition of the wall while the workers were absent. for lunch. Fire hydrants were not connected at that level and CO2 extinguishers failed to put out fire. After burning for half an hour, the fire was extinguished by station fir~men after hoses were pulled up from ~ ground le'/e 1 hydrant. Thi s mi shap resulted in major damage to the facility.


Causes

Inadequate work control procedures in that the contractor failed to enforce adequate fire preventive procedures 1urlng welding/ cutting operations and failed to provid~ proper training for his workers. Contributing were contractor failure to station a watchman i~ the work area when the torch cutting operations were suspended and management failure in not ensuring that the service tower water system had been connected to the station water supply prior to operations on the tower.

*This mishap was not associated with manned space programs; however, it was consIdered significant enough in terms of amount of. loss and lessons learned to include in this summary.


Action

Designate all operations which use welding/cutting torches or electrodes as hazardous. Require fire safety inspection of all welding operations prior to commencement. Ensure that work control procedures provide for implementation of fire safety precautions, such as use of asbestos blankets to catch sparks and molten slag, and/or briefing and/or certification of workers on hazardous operations. Require a fire watchman to be posted during breaks and lunch period and for a minimum of one hour following operation shut down in all areas where welding/cutting operations are underway near flight systems.

--.l r\)

65.

66.

67.


During fueling of a space vehic Ie at a test facil1 ty, h,ydrazine fuel was inadvertently pumped from the storage tank through the waste pond rather than into the vehicle's fuel tank.

While using an acetylene torch to loosen rusted strap hold-down nuts on a hydrogen trailer, workmen discovered two H2 cylinders still held over 2000 psi pressure. No mishap occurred, but the risk of explosion was great.

During a manufacturing leak check of a fuel system ball check valve, leak test compound was drawn 'into the ball valve's actuating cylinder through a .vent port, resulting ;in removal, cleaning, reinstalh,tion and retesting of the valve.

SECTION IV FUEL/PROPELLANT SYSTEMS

Causes

Personnel error in which a technician failed to close the fuel dump valve in accordance with operating procedures although he and QC verified that it was closed on the work sign-off sheet.

Personne 1 error. C'y linder s were inspected and erroneously tagged as inert. Contributing was inadequate work control in that during a subsequent inspection, the torch was allowed to be used before inspection was completed.

Personnel error in that technician failed to exercise proper cal:'e in carrying out leak test procedures.


Action

Implement safety training and aw~eness programs to motivate all personnel to be espeCially attentive to comply with all work control nrocedures in hazardous operations.

Require formal safety approval before torchee may be ueed near flammable gas producing or storage facilities and equipment. Require depressurization, purging and certification prior to placing inert tage on H cylinders.

2

Ensure that leak test technicians are adequately trained and instructed in leak test procedures and means to avoid contamination of test articles.

-.) w •

68.

69.


During manufacturing and while performing LH..:, propellant valve pu~ge flow checks on an 0 a.. bu'rner, 9-port~b1e flow meter ruptured and was destroyed when inadvertently subjected to excessive pressure due to sealed flow meter discharge pqrts. Three workers sustained minor injuries.

During torque wrench tightening of Ii "B" nut on a GSE fill/drain/ feed line attached to a spacecraft oxidizer fill/drain/feed line l

the feed line buckled due to overstress caused by leverage of tbe torquing operation.

SECTION IV FUEL/PROPELLANT SYSTEM!

Causes

Personnel error in that techniCian failed to check the flowmeter discharge ports, which were sealed with threaded B-nut caps. Contributi.ng was a design deficiency in that no inlet low pressur~ relief valve was provided in the flowmeter configuration.

Deficient assembly procedures in that off-vehicle assembly of the GSE fill/ drain line could have been accomplished prior to connection to flight hardware.


Action

Require that portable flowmeter installation and checkout proc~dures include caution and warning notes about removing seals or caps from discharge ports; require checklist verification of test set-up prior to initiation of test. Where possible l provide for and require the use of relief. valves in portable flowmeter installations.

Avoid assembly of GSE lines after attachment to flight systems; require a bench assembly to the point of GSE/flight hardware interface.

.....;J -r::-

70.

71.

Accident/Incident Descr1ption

Five personnel were exposed to toxic nitrogen tetroxide fumes when ~ vapor cloud was in~dvertently released without warning during oxidizer loading operations in ~n adjacent work area 150 feet directly upwind of their work area.

During checkout of fuel vent quick d1sconnect hose assemblies, a fuel weigh tank top was blown off and attached flex hoses, tubing, and gage were destroyed. There were no injuries.


Causes

In~dequate work control procedures in th~t there was lack of .coordination of safety responsibilities between the two work areas; and no "on-site" procedures for local evacu~tion of individual work areas.

Persor.nel error in that a test valve was incorrectly positioned (opened) causing overpressurization. Contributing was an inadequate checklist which permitted bypassing a sequence check, and resulted in tank being pressurized due to the open valve.


Action

Establishl procedures for assignment of responsibility for overall safety of all hazardous operations between all potential hazard areas. Ensure that all hazardous areas have an effective evacuation plan consistent with the type or types of emergency potential.

DeSignate all fuel system checkouts as hazardous. Require safety review/analysis of procedures and checklists to ensure adequacy of caution and warning notes, and to identify safe sequence of operations. Require that checklists be followed without deviation whenever fuel tanking and detanking operations take place •

--..:J \J1

72.

AcCIdent/IncIdent DescrI:QtIon

DurIng preparatIon for test fIrIng of a spacecraft ·system engIn~ a fuel (helium saturated aerozine-50) auxiliary conditioning unit (ACU) electrical heater assembly on the test stand ruptured, due to auto-ignition of fuel vapor within the heater case, r~sultlng in minor ACU and test stand damage, and inhalation by nearby workmen of toxic fuel vapor created by the rupture. The rupture' occurred after the heater unit had been turned on but prior to start of fuel flow.

SECTION IV FUE~PROPELLANT SYSTEMS

Causes

Deficient test GSE design in that the heater used (calrod immersion type) permitted direct contact between the heater elements and ~ flammable liquid; the heater orientation within the ACU created a high point vapor trap thus exposing some of the heater elements to fuel vapor; the design provided no electrical interlock to preclude energizing the heater prior to starting the fuel circulat1ng pump; the heater controls were placed in such a configuration that they did not reflect the true temperature within the heating unit. Contributing was a deficiency within the test procedures that permitted energizing heater coils before c1rculation of fuel was established in the test sequence.

Recommended PreventIve/Corrective

Action

Require the use of a non-hazardous intermediate heat transfer fluid such as water to separate hazardous fluids from direct contact with heating elements. Require safety review/an~lysls of hazardous test procedures to verify compatibility between procedures and test set-up, and to identify safe procedural sequencing.

---J 0'1

73.

74.

Accident/Incident Descripti~on

During replacement of a millipore teflon filter in an aerozine-50 fuel system, the element burst into"fla.me as it was placed on the f~lter plate. The resulting fire was extinguished with water spray. No personnel injury.

During fuel eonditioning operation at a test facility when the fuel inlet line to the pump was opened toxic fuel spilled onto the ground through the outlet valve which was in an indicated closed position. Seventy gallons of fuel were pumped out onto the ground before the inlet line could be closed by "scape" Buit procedures.


Causes

In~dequate QC because ~ non-compatible filter was used with aerozine-50, resulting in ignition of the element and the residual fuel in filter bowl assembly. A contributing cause was th~ nearly identical part n~mbers of the correct and incorrect filters.

Inadequate laboratory maintenance procedures which made the valve handle indicate closed when the orifice was actually o,en.

Recommended Prevent 1ve/Corr'ect 1ve

Action

Require QC verification of replacement parts, pr10r to ins'~allation, on any fuel system to ensure compatibility.

Ensure that indicating valve ~aintenance proced1)res require functional/ visual check of valve for proper indication prior to release for in~tallation.

75.

-.oil -..J •


During removal of a spacecraft module fuel tank assembly from a holding fixture during manufacturing, the assembly contacted the fixture and sustained d~age to fuel line and bellows, due to close clearances between the tank and the holding fixture.


Causes

Inadequate work planning in that a hoist was selected and used to remove the tank from a close tolerance f1xture. Contributing was deficient fixture design due to lack of consideration for part B removR,l and handling clearance.


Action

Require the use of "hydraset" control with hoists when removing parts from close tolerance fixtures. Require manufacturing operations review of holding fixtures designs to -assure compatibil1 ty with parts removal operations.

.. -, ... j

~ co

19.


SECTION V LIFE SUPPORT SYSTEMS

Causes

During purging and inspection Personnel error in that the of a life support system, ~n cabin ~tmosphere h~d been employee entered a sp~cecraftimproperly certified ~s cabin with oxygen deficient breath~ble. Contributing atmosphere and was rendered W3.E' the erroneOl'S c lassifica-partl~lly unconeclou5. tion of the inspection pro

cedure as "no safety h8.Z'3.rd involved."

20. During verlflc'3.tlon Deflclen~ compatibility te~~ ~~cedures i~ th~t a design HnU..t~t!cm of the lif~ support system was not recognIzed during proceduri~s de'.relopment. T}-.i s limitation allowed water

.test of a life support system the test was premature.ly terminated due to failure of an oxygen clrcul3.tlon fan/ motor within the system to start up, c~used by corrosion seizure of a fan/motor bearing. Subsequent investigation revealed that the corrosion was caused by w~ter which had been introduced unknowingly into the life support system o::ygen loop during a previous spacecr~ft/ life support system compatibility test.

"

to be introduc~ unknowingly through a closed water shutoff valve (leakage) in the system, under conditions of test pressure/time ~pan. As a consequence, ~vail'.ble oxygen loop dry-out proceodures used w~en water was knowingly introduced into the loop w~re not implemented.


Action

Designate ~ll life support system purging operations as hazardous. Train and certify all personnel involved in these operations for their jobs. Require s~fety clearance prior to opening and entering sealed spacecraft hatches.

Require s'3.fety r-=view/ analYSis of safety critical systems test procedures dur:ng their development, to ~ak~ certain that the test oper'3.tions will provide timely remov'3.l of all system contamInants that may be introdu~ed by the test conditions.

--l \0


21. During a rehearsal of a simulated altitude chamber test, a ribbon antenna atop a mobile life support system was cracked halfway through.

22. During manufacturing

23.

de - so ldering opera t.ions on ECS p.lumbing, Methyl

. Ethyl Ketone (MEK) used as a solvent caught fire. No damage·. or inJury.

During the removal of an environmental control unit from a flight module, a water-glycol line on the unit was bent ~nd subsequently broke while being straightened.

SECTION· V LIFE SUPPORT SYSTEMS

Causes

Design deficiency in that the life support system thermal cover flap was inadequate to prote~t the stowed antenna from being damaged during the couch change-out exercise.

Procedural in that flammable MEK was not prohibited for use in soldering operations • Contributing was personnel error in using a soldering iron before th~ solvent was completely dry, and supervisory failure to prevent use of a flammable solvent near a heat source.

Inadequate work control procedures in that the waterglycol line was not adequately protected.


Action

Assure that deSign of protective covers over life-support systems provide shielding against damage for protruding parts of ancillary system components.

Avoid use of MEK during soldering operations.

, Require training and certification of personnel assigned to remove/install equipment in spacecraft, to emphasize avoidance of equipment damage. Require installation of protective barriers/blankets and warning placards during equipment installation and removal.

---,~

Q)

o .

·~, I"

AcCident/Incident Description

24. While att'lching a 3/8" water glycol line during installation of a flight fuel cell simulator, the line twisted out of blueprint configuration before reaching torque 'lalue on attaching f'B" nut. resulting in removal and replacement of the line.

25. During assembly leak test of an ascent stage water system, contamination fluid from a le~ meter was pulled into the water system lines due to omission of a step in the test procedure that required leak meter disconnection.

, j,


Causes

Material failure in th3.t the B-nut rotated freely, but its sleeve was frozen to the tube. Contributing was inspection failure to identify ~he derec~ive line prior to installation operations~

Inadequate work control of test operations that led to a momentary lapse in attention by an experienced test team. Contributing could have been the lack of 3. caution note in the procedure at each step where leak meters were scheduled to be disconnected.


Action

Designate fUght systems lines safety critical items, req~iring QC tagging and validation during receiving/issue actions and prior to installation operations.

Require the use of formal procedures/checklists during leak test of program essential equipment to verify proper test sequencing. Require safety review of leak test procedures to provide caution and warning notes.

co ....

26.

27.


During a space suit fan functional checkout, as a result of an unscheduled test shutdown, a fan designed for use at 10 pSia was inadvertently run for It minutes at full atmospheric pressure and potentially damaged. There were no injuries.

During post leak test disassembly of an oxygen purge system oxygen regulator a damaged "0" ring seal and "delta." ring were found; the d~a.ge was due to their improper installation at the time of regulator assembly. .


Causes

Personnel error in that there was a failure to follow approved. written procedures to cut electric power to the fan before shutting off the test system vacuum pump.

Deficient procedures governing regulator assembly/ inspection in that there was no requirement to verify the proper installation of the seals during assembly operations.


Action

. Require ~se of checklists in conjunction with written procedures to ensure completion of essential steps in test sequence of flight systems.

Require formal manufacturing QC procedures to control assembly of non- . m~tallic seals and parts; require inspection to verify their proper installation during assembly.

co I\)

28.


During manufacturing one sector of a spacecraft sun sensor was broken loose during removal of its protective coyer preparatory to painting the sensor supporting structure.


Causes

Inadequate work control. Workman removing the cover was not authorized or trained to do so.


Action

Ensure that only tr3.1ned and certified workmen are used to install and remove flight hardware and related pro:ectlve covers.

,

CD W

1.1

Acc 1 dentjInc 1 dent DeacriE!1on

SECTION VI ORDNANCE SYSTEMS

Causes

No Accidents/Incidents pertA.lnlng to Ordnance Systems recorded 1n the 1970-1971 per1od.


Action

en .;::-


120. While being proof tested to 6000 psig, a stainless steel braided flex hose in a test fixture line ruptured at 3000 psig. No injuries.

121. During laboratory test evaluation of a regulator, a flowmeter exploded, injuring two technicians.

122. While being proof tested to 6000 psig~ a flex hose ruptured at 4000 psig. One employee sustained minor injury.

SECTION VII PRESSURE SYSTEMS

Causes

Personnel error. The hose was incorrectly tagged for test to 6000 psig, which was above its burst rating. Contributing was inadequate inspection procedures which allowed the incorrectly tagged hose to be set up for test.

Personnel error because the flowmeter outlet diameter had been reduced from 1-1/2ft to 1/4n~ restricting flow, thus causing meter to exceed its 'design pressure and explode. The modification was not authorized by approved proG!edures.

Personnel error. The hose was incorrectly tagged with a proof pressure that was actually above its burst rating. Contributing was inadequate inspection procedures which allowed the incorrectly tagged hose to be set up for test.

Reconunended Preventi ve/Col'recti ve

Action

Ensure that hose part numbers are checked against listed pressure ratings prior to tagging. Require that pressure rating tags be checked against part numbers and validated prior to proof testing.

Require standards/procedures for laboratory modification of high pressure equipment. Require inspection of high pressure equipment modifications prior to operation.

Ensure that hose part numbers are checked against listed pressure ratings prior to tagging. Require that pressure rating tags be ohecked against part numbers and validated prior to proof testing. Ensure that personnel protective equipment is adequate in pressure proof testing areas; barriers should be installed to isolate the test set-up.

co \J1


123. During development and qualification testing. a facility high pressure air line operating at a normal 3400 psig pressure fa iled at an elbow swagelock fitting and caused minor damage to the building fixtures from consequent whipping action.

124. During operational testing of a space flight simulator, a 3000 psi hydraulic line pulled out of its "B" nut connection and sprayed hydraulic fluid over a portion of the facility. No damage or personnel injury.


Causes

Improper assembly in that a reused swagelock fitting did not match the type of tubing used and was improperly fitted. Contributing were a design deficiency in that the assembly drawings used were not approved by qualified engineers; QC failure to inspect for proper fittings and workmanship; and inadequate t ie-dO\.\'l1 of the air line.

Improper installation of the line assembly in that the "B" nut was loose, allowing pressure on the line to straighten out the tube flare causing the line to blow out from the simulator unit.


Action

Require certification of personnel assigned to assemble and maintain high pressure systems. Ensure that design of high pressure systems is performed by quslified and experienced personnel. Require formal QC inspection of high pressure systems for compliance with design specifications prior to system activation. Ensure that all high pressure hydraulic and air lines are secured at 6-foot intervals.

Require formalized procedures to inspect and verify pressure connections for program simulator equipment prior to test commencement.

en 0\


125. During operational checkout of a test equipment modificat ion in a down flow clean room, a 60 psig air line was inadvertently connected to a vacuum gage port, resulting in destruction of an absolute pressure gage.

126. During visual inspection of a high pressure system in a facility supplying gas . to test cells, desiccant particles were found, resulting in a shut-dm~ of the system for investigations and repair.

4


Causes

Procedural due to lack of detailed checkout/activation procedures and checklists and lack of QC certification. Contributing were test system design deficiencies in lack of positive identification of inlet and outlet ports and lack of an absolute gage pressure relief valve.

Inadequate supply system de·. sign in that one of the drying filters ruptured, caused by a normal rapid pressure drop on the downstream side of the filter, creating a venturi, or vacuum, effect.

Rcconunended Preventive/Corrective

Action

Require that formalized test set-up and operational procedures be established for activation/testing of pressure s:,1stems which include precautionary warnin::,;s and QC verification. Inlet and outlet ports should be clearly marked, and designed to prevent inadvertent cross connections. Require installation of pressure relief devices on all pressure gages.

Require that pressure systems used in test of flight hardware be designed with sensing and relief devices to detect pressure variations and protect critical filters in the system; support design development with system safety analyses/reviews.

en --.;J


'I

127. While operating the purge and vacuum console during pre-launch checkout, the operator turned the regulator clockwise instead of cOlUlter-clockwise. resuI t ing in overpressur ization of' the system. No damage resulted.

128. During vehicle assembly at a latDlch facility, a heliwn control system solenoid va 1 ve on an engine was found to have four radial scratches across the outlet port sealing surface. The valve was rejected from service.


Causes

Personnel error in that the technician turned the regulator in the opposite direction from that called out in the test procedure.

Personnel error. Failure to carry out the required complete inspection of the valve during source inspection.


Action

Ensure that test operators are certified and trained in pressure system adjustment techniques. Require caution and warning notes in test procedures governing pressure control adjustments. Use directional decals/placards on test consoles to indicate proper adjustments.

Require the use for formal checklists during source inspection of program critical equipment to verify completion of all elements of the inspection sequence.

~

co (;J


129. During oxygen sampling of the crew umbilical system of an altitude chamber, a GOX hose was erroneously disconnected, pressurizing the hose to 173%. of design burst level. The hose did not fail and there was no damage or injury.

130. \'lhile investigating apparent nonoperation bf a gas generator blade valve during system checkout t employee had finger amputated when the valve was suddenly activated by an operator at a remote location.


Causes

Des ign deficiency in that interconnect hose fittings contained a self-sealing valve \l7hich caused the hose pressure to increase above deSign burst level following inadvertent disconnect. Contributing was a pro-cedural error in disconnecting the line while still pressurized.

Failure to follow approved safety precautions in that the employee had not informed the engineer in charge of valve activation that he was working on the valve; there was no continuing communication between the remote operator and the workman, and no lock-out procedures to prevent valve activation.


Action

Review design standards for LOX and GOX hose connections to ensure the prevention of bose overpressurization following inadvertent disconnect. Require check-off verification of depressurization prior to all hose disconnects.

Require that system troubleshooting operations be approved by the engineer \'1ith functional control authority over the system prior to conmencement. Ensure that system controls are "locked out" either mechanically or with warning tag while the system is being worked on. Ensure positive communication between employees working on systems at remote 10-cations and operators and engineers in charge of system activation.

OJ \.0 •


,1

131. During leak check of a test pressure container, the burst disc of the container ruptured due to overpressure caused by incomplete closing of the manual test gas valve, resulting in minor injury (ear drum damage) to three

wor]Qnen.

132. During pressure adjustment to reseal a mercury sealed piston in a flow rate calibrator, a pressure gage on the test bench exploded due to inadvertent application of overpressure fran the suPply source, resulting in injury to a test technician (shattered tempered glass dial cover showered face and upper body with glass fragments).


Causes

Inadequate test set-up design in that the test gas system contained no relief valve or pressure regulation within the safe working pressure of the test article. Contributing was the failure to follow procedures in that closure of the test gas valve was not verified.

Inadequate test bench design in that there was no automatic pressure relief device between the exploded gage and the supply source; the exploded gage had no safety shield; and there was no pressure gage to indicate the amount of pressure applied to the calibrator. Contributing was inadequate work control in that pressure

. valve/regulating devices on the test bench were positioned without authorization during the resealing operations.


Action

Require installation of pressure regulators and relief devices in test pressurization systems when source pressure exceeds safe working pressures of pressurized containers. Require positive verification of pressure application/, isolation valves positioning during application of test pressures through QC and/or supervisory checklists.

Require installation of pressure relief devices on all pressure gages and at other critical locations in test pressure systems. Require installation of pressure gages in maintenance/test set-ups to indicate applied pressures at work stations. Require installation of safety lenses on test bench pressure gages. placard test pressure systems for operation by authorized personnel only •

\,Q o


133. A helium cylinder located in. a K-bottle facility storage rack suddenly burst and released "all of its contents as a result of a ruptured disc in the valve assembly.

134. During operational test and checkout of a spacecraft, a ~ter glycol quick-disconnect (QD) was mated to the wrong port. There was no damage since the system was not pressurized. The spacecraft was tested for contamination and the flight half of the QD was changed. .

<I

~ECTION VII PRESSURE SYSTEMS

Causes

Inadequate storage procedures in that the K-bottle storage rack was located under a translucent sheet roof which allowed sun's rays to overheat/overpressurize the cylinders.

Inadequate procedures .due to the lack of warning notes in test and hook-up checklist. Contributing was inadequate design in that the QD configuration was such that it could be rrated to a wrong port.


Acti.on

Ensure K-bottle storage procedures require sheltered storage to protect bottles from overpressurization from heat sources.

Provide warning notes in procedures and checkli.sts \l7here it is poss ible to make wrong connections. Require QC verification of all flight systems test setups. Ensure that adjacent coimec-

tors are properly coded, marked, or sized to avoid mismating.

"

\D I-"


:tl

135. During run-in of a high pressure air compressor used for laboratory testing of flight hard\'lBre, the fifth stage oil separator of the compressor exploded, due to autogenous ignition of an oil/air mixture in the exit pipe, propelling .fra~nts of the separator throughiout the builclin~ and through the walls and roof. No one was injured.


Causes

Deficient desi~ of air compressor system in that automatic cut-of£ temperature sensors were so located that they could not detect the temperature of the discharged air at the area of the explosion. T~1e temperature approached lmOoF lIDder run-in conditions, the approximate autozeneous point of the 'nineral based lubricatinz oil used in the CG~pressor system under maximum stage discharge pressure.


Action

Require hazard analyses to be performec on laboratory/ facility pressure equipment which is used \.,ith flight hardwal~ prior to operations and require safety approval. Specify LIse of synthetic lubricants in place of mineral base oils when potential .operating temperatures may exceed 350°F.

1.0 I\)

•


136. During preparation for an underwater test in a test facility, a sealed battery box conta,ining two lead-acid batteries was being pressurized to 'approximately 10 psi from a 110 psi source when the box blew up due to overpressurizatian, resulting in battery breakage. There was: no personnel injury or unacceptable tank contamination.


Causes

Inadequate design of pressure source system .in that t;1ere was no pressure regulating or relief device between the 110 psi supply and the connec-

tion to the battery box. Contributing was management failure to implement formal design control of the battery box in that the box t-:as a "locally fabricated it:em TT

with no identification of safe working pressures. Also contributing \'las a procedural error in that, although the box was equipped with a shut-off valve and a gage, the valve was either open when the 110 psi source was connected or it was opened too fast: during pressurization.

Recommended Prevent1ve/Corrective

Action

Require installation of pressure rerrulators and automatic relief devices in source lines when source pressures exceed safe working pressure of pl"essure receivers in test pressurization systems. Require formal design control of all pressurized containers used in tests. Label pressurized containers with safe working pressures and periodic proof pressure test require~ts. Require the use of formal procedures/checklists for the proper sequencing of operatiom in pressure applications.

"

\0 W .


137. During proof pressure testing of a coolant serv ic ing WI it , a flowmeter within the unit ruptured due to overpressure and showered glass fragments within the enclosed test area. There were no injuries or ather damage.

138. During operational test and checkout flow testing of a spacecraft reaction control system engine, pressurization of the system caused leakage in an oxidizer isolation valve, which went unobserved unt 11 the oxidizer propellant tanks were pressurized to 20 pSig, approximately 4~ of design burst. There was no damage and no injuries.


Causes

The test procedures required application of 460 psig pressure even though the flowmeter wa. rated for a safe maximum working pressure of only 230 psig.

Inadequate test procedures in that the procedures failed to sufficiently recognize the possibility of pressure leakage through the oxidizer isolation valve and overpressurization of the oxidizer tanks during the test sequence.


Action

Require checklist verification that test pressure requirements are within safe operating limits of test equipment. Limit proof pressure tests to 1.5 times maximum safe working·pressure of test equipment. Ensure that proof pressure requirements for an assembly are compatible with assembly components during development of test procedures.

Identify all tests requiring pressure applications to flight systems as hazardous; require safety review/analysis of test procedures during their development, to ensure entry of required caution and warning notes~ and safe test sequencing.

\0 ~


139. During acceptance testing of an APS module, the module bellows assembly was permanently distorted due to the application of test pressure approximately 130 psi above the maximum allowable. The bellows assembly had to be replaced.

"


Causes

Personnel failure to properly position valves as required by the test procedure. Contrihut ing was lack of requirements for positive verification and communication of correct positioning of valves during the test sequence.


Action

DeSignate flight hardware pressure testing operations as hazardous. Require safety revi~" and analysis of such operations to identify potential hazards. Institute positive communication and verification procedures for all configuration changes required during test operations. Require a "dry run" to validate proposed pressure test procedures for critical flight hardware.

\.0 \J1

Accident/Incident Descri;R.tion

27. Durine a manufacturing check-valve verification leak test on a space vehicle propulsion system, a technician working on the vehicle, using a drill motor, slipped and nicked a fuel line which was under test.

23. During cleanup of a minor fuel leak from a pressure regulator in a propulsion system valve box, several pol~'propylene felt cleanup pads were slightly charred. No damage or injuries resulted.

SECTION VIII PROPULSION SYSTEMS

Causes

Inadequate work area cO!1trol. The leak test was be ing performed in a limited access area and test procedures required no work on the vehicle during test operations. Contributing was personnel error in use of the dr ill.

Personnel error in that technician failed to follow established procedures, since clean-up pads were not sufficiently water-dampened prior to being used to absorb fuel.


Action

Require supervisory and QC verification of work area clearance prior to initiation of test operations in limited access test areas. Ensure that using personnel are trained and L~structed in the proper use and positioning of drill motors in the vicinity of pressurized lines and tanks.

Designate all fuel clean-up operations as hazardous. Require all personnel involved in fuel clean-up to be trained and certified for their job.

::11,11

\.0 0>


29. Dttrinr; removal of engine from test stand afte'r completion.ofdevelopment test fir in~, three technicians inl'ulled toxic aerozine-.SO fuel vapors that had been entrapped in the engine and discharged at the en.gine corinect point.

30. Nhile removiIlgan engine LOX inl:et duct dur ing manufactUring assembly operations ,. water in the bellows convolutions puured into the LOX turbo pump, nece'ssitating removal and reconditioning of the 'pwnp.

"


Causes

Inadequate Nork control pro-' cedures in that the tecfL."1icians \.;erenot wearing' proper protective clothing f.or this type activity in . which residual fuel and oxidizer vapors can be expected even after engine purging operatian~.

Inadequate inspection since the weep holes of the inlet duct and the shroud of the

. pump bell housing had not been covered and sealed as required, thus the collar area of the inlet duct permitted water to remain trapped below weep holes of. the duct.


Action

Establish \\'Ork control pro.cedures which define the proper protective clothing to be worn forremova'i of liquid propel-

lImt engine6 from test stands after .they have been operated.

Require use of checklists in perfol"l'ltance of assembly inspectiOns to record and verify that all inspection steps have been carried·Out.

'.

~

Accident/Incident Descri~tion

31. . Dul."'ing installation of a spacecraft propulsion engine, the railiilg of the engine stand pressed up aga"inst a fuel vent line and dented.it~

32. During instrwnent modification work on a spacecraft engine. a welding machine .operator misinterpreted a voice communication from the interstage area and applied power to the tube ~ding head whileit was .in contact with the engine work platform, shorting the head to the platform. No damage to the engine; however, the potential existed.


Causes

ProCedural deficiency in that there was failure. to communicate essential information concerning change :in engine configurat ion to inst~latian personnel; this particular engine had its fuel vent line routed 5 inches lower than in previous engines, and the pneumatic--tired stand raised up when pavt of wovking load was removed.

Inadequate work control in that there was a failure to provide adequate communicatiOns between the interstage and the welding operator.


Action

Ensure that installation/test procedures used in conjunction with pneumatic-tired work stands proVide cautionary warnings to make allowances in stand.s T height due to load.

Require hardline voice/v isual communications amon~ welding team members on flight systems. Require review of communication techniques prior to start of welding operations. Require safety approval of welding setup. Ensure that welding machine operators and technicians are certified and instructed in procedural communication techniques. -

\D OJ


33. During removal and replacement of booster engine LH? prevalves, a prevalve spacer was scratched in three places.

34. During "helium systere leak test pre-static engine checkout at an assembly facility, a growing bubble le~ was detected at the mating flanges of the heat exchanger helium supply duct and the helium supply wrap around duct, resulting in replacement of the seal.

35. During maintenance installation of a replacement O-ring on an engine igniter fuel line, four O-rings were found cre~sed in their package, resulting in rejectivn for use.

..

SECTION VIII PROPULSION SYSTEr~S

Causes

Inadequat;e maintenance and installation procedures. Contributing causes were inadequate supervision and personnel error.

Personnel fa~lure tc ro~low established installation procedures/techniques in that 80 degrees of the seal's teflon coating had be~n peeled orf as a result of improper installation.

Inadequate/improper packaging s~nce procedures called for the O-rings to be packed so that theJ" would remain in their natural shape. Contributing was ir.ad'~qL:ate inspection of packaged products.


Action

Require that all personnel be certified for work or. flight hardware a~d require that specific installatio~ procedures are prepared and followed.

Re<p ire that critical component installation proce1ures be unders:oon and that personnel are trained and certifiej ':"0 perform such operations. Ensure that inspection procedures and checklists provide for specific checkoffs, as appropr.i.ate, during installation of cri~ical components on flight hardware.

Ensure that packaging a~d packaging inspection personnel are +:rained. and cArtified in p~oper pa~ka.giJ"g tec'lriquesj 3.nd the use of approved. p~ckaging proc~dures.

\0 \£) .


36. During manufacturing checkout leak test of an engine hydraulic system, the braided flex hose connected to the gimbal filt~r m~nlfold supply pressure tap leaked at a severely damaged area resulting in replacement of the hose.

37. During engine development testing a circuit malfunction ir. the facility cutout system led to premature ~nglne cut-off. No damage.


Causes

Inadequat~ pre-~est inspection procedures in ~hat the failed hose was i11 an inc1p1ent failure condition, that could have been detected by visual inspection (damaged braid and permanent bulge set).

Personnel error. The thrust chamber exit igniter indica"tion devic~ waE inadverte~tly wired into the cutout system, there was no evidence that test wire connections had bee~ inspected.

II~I


Action

Require formal QC inspection and verification of test pressure set-ups before application of test pressures to or around progrrun essential equipment.

Require formal qc inspection and verification of test wiring connections prior to ~pplication of power to program essential equipment.

..... o o


38. An engine injector became contaminated with rain water while in its storage contai~er in a storage warehouse due to a leak in the building roof and lack of cover on the storage container.

39. During a flight engine pre-stage checkout inspection following removal from storage, it was discovered that there was minor damage to the thrust chamber tubes, requiring repair •

. "


Causes

Personnel error in that the stor~ge container cover had b~en removed to inspect the condition of the container dessicant ~~d had not been replaced. Contributing was a management deficiency in that there was a failure to have proper tuilding inspection to detect roofing deterioration.

Inadequate storage inspection proced~res since the.protective engine cover had not been installed, and the stage was dam.aged when struck by some sharp object.


Action

Ensure tt1a: program hardware inspect.ion procedures require immediate replacement of ~rotec~ive coverings when inspection is completed; require use of "buddy system" and checklist verifi~atio~ when inspection~ are performed in isolated. areas. Req'..lire pre-storage inspection of storage ~acilities for program eSSential equipment to ens~re they will provide the required protectio.1; .'l:1.d oerform periodic (at ieast quarterly) inspection and corrective maintenance.

Require forrr.al procedures and checklists to verify installation of protective covers on flight hardware placed in storage.

..... o ~ •

Acc1dent/lnc1dent Description

40. During a leak check procedure on a spacecraft propulsion system during assembly operation, the overhead workstand was moved while ~ propulsion flex line was still attached to it, causing damage to a 11ne connector and mount1ng bracket.

41. During installation of a tube assembly on a spacecraft engine, a tube weld purge could not be accomplished. Inspect ion revealed a piece of plastic film plugging the tube passage.


Causes

Inadequate work control in that the workstand was not cleared of f1exline connections before being moved. Contributing was personnel error since the incident was partly due to carelessness during the test procedures.

Deficient inspection procedures governing processing of plugged tube from manufacturer to point of installation, in that plastic film was used to protect tube ends, and its presence in the tube was undetected in its process through an undetermined number of shipping/receiving points; there were no procedures to verify the internal cleanliness of the tube ~diately prior to installaticn •


Action

Use formal procedures and checklists during assembly/test of flight systems to verify completion of all operations prior to movement of workstands.

Require formal QC inspection! verification of cleanliness of internal tube/piping areas immediately prior to installation in flight systems.

::

11'

f-I o I\)


21. Following removal of a protective hard-floor covering during manufacture of a flight module, the module floor \,las fotmd to have a one and a half inch long triangular puncture.

22. During \'leight and balance testing of a spacecraft in a manufacturing facility, the turn buckle on the sling being hooked to the top of the craft contacted the craft and broke off a finger seaL

23. While performing work on top level platform of a spacecraft module, a torque wrench slipped fran technician's hand. falling and striking aft bulkhead structure, causing a 1/16 inch nick.

. "

I,I, I

SECTION IX STRUCTURAL SYSTEMS

Causes

r-Iost probable cause \'las personnel error in allowing the hinged hard floor supporting frame to fall against the module floor during either installation or removal.

Inadequate work control since one leg of the sLing \.,as not pulled taut enough to prevent the sling from contacting and breaking off the finger seal. Contributing \I]as failure to provide required protection for the finger seal.

Inadequate work control procedures in that there were no protective or restraining devices used to prevent a slipped wrench from falling.

" I


Action

Require training and certification of IE rsonnel involved in installation of protective flight module coverings.

Require any in-plant movement of flight rardware to be under the direct supervision of a designated move conductor. Ensure that required protective devices are used.

Require the use ~f protective nets or restraining devices on tools being used on elevated work platforms.

...... o w


24. During the lifting of a launch vehicle section, a hold-down bolt in the aft support structure over-sn-essed the vehicle's aft skirt section, resulting :in minor damage.

25. During manufactur:ing, a titanium propellant tank \'las undergoing final internal inspection by means of an X-ray anode tube which was left inside the tank unattended. Overnight, a leak developed at a hose connection in the X-ray tube cooling system which half-filled the tank with water, collapsing and totally destroy:ing it.


Causes

Personnel error in that the bolt was not removed 85 required prior to lifting. Contributing was improper inspect ian in that several inspection teams had certified that all bolts \'1eI'e

removec..

Inadequate \,"ork procedure5 in that cooling system hoses were not checked for proper installation since a kinked hose caused a pressure buildup which resulted in the hose backing off the nipple. Contributing causes were a design deficiency in using adhesive tape on ~ose connec-

tions to restrain hose from pulling loose; and a management deficiency in that the tank manufacturer failed to follow instructions of the contractor to remove the xray tube from the tank whenever it was to be left unattended •


Action

Ensure that inspection personnel are qualified and certified for their specific job. Ensure that hold-down bolt removal procedures and checklists identify and req~ire verification of the nwnber of bolts re'l1oved.

Require that QC verify proper installation of test equipment used ,'lith critical hardware. Prohibit the use of test equipment which does not use mechanical hose clamps for all hose connections. Require use of a checklist to ensure correct procedures for shutdown of test/ inspection opera,ions on program critical hardware.

...... o -'='


26. During co:.mtdm'lIl demonstration test at a launch facility, the spacecraft boost protective cover (BPC) hatch latches die. not retract prior to hatch closure, resulting in minor damage to npc.

27. llJhile ra1smg the hydraul.ic \V'o:::,k platform around the spacecraft, the kick ·plate oame in contact \'iit:-, the spacecraft tunnel, causing a 2" tear in tile lOtV'er edge of the tunnel door.

28. During manufacturing, a spacecraft side hatch \V'8S

closed on and crushed a live portable light cord, resulting in arcing which burnt two small indel1tations on the hatch frame ledge •

•

SECTION IX STRUCTURAL SYSTEHS

Causes

Inadequate procedures in that test procedures did not call for verification, visually or otherwise, that hatch latches were in open position.

Inadequate supervision and work cmtrol in that a visual inspection for determining adequate clearances for the platform was not made before and during the raising operation.

Personnel error in that a technician failed to remove the light cord before closing the side ha tch.


Action

Ensure that test procedures require positive verification of positioned devices during test sequence.

Require that two men always be assigned to raise or lower any \'10rkstand; one man to operate the raising or lowering mechanism, and one man to assure hardware clearance.

Require supervisbry or inspection approval prior to opening or closing spacecraft hatches. Install restraints on open hatch doors to prevent inadvertent closing.

f-' o \J'1


29. During manufacturing assembly ope1'8t ions, a stage tank was subjected to possible negative pressure differential and damage, due to failure to uncap the breather port of the tank desiccant canister following canister connection to the tank.

30. During the horizontal paint and rolling operation on a stage tank, a temporarily secured flange became loose and fell inside the forward skirt area, resulting in minor damage to mylar on forward dome and a small ding in a thermo-conditioning system 1 ine.


Causes

Inadequate work control procedures since the canister was both disconnected and reconnected to the tank without documented authority or procedural instructions; as a result, the mechanic making the reconnect ion failed to uncap the breather port.

Inadequate inspection procedures in that after the desiccant system had been reinstalled following tank pressurization for an engine leak check, the temporary flange was imprcp!rly stowed inside the tank.


Action

Require the use of formal procedures and checklists to attain and verify the proper configuration of flight equipm ent during all assembly operations.

Require accountability for all equipment and tools upon the completion of specialized operations involving flight hardware. Require inspection and certification when any item has been stowed temporarily on flight hardware.

~ i

f-J o m


31. During test preparation. a control handle fell off an overhead hydraulic hoist and punctured a spacecraft bulkhead, allowing Bpproximately a gallon of hydraulic fluid to spill on the bulkhead and leak onto equipment inside. The long range effects of the fluid contmnination are lUlknowIl.

32. During manufacturing test preparation, the floor skin of a flight module was torn when a workman dropped one end of a crew couch.

•


Causes

Personnel error in that the hoist passed receiving inspection with an L~properly installed control handle set screw. Contributing \'las .lack of procedures requiring special inspection of flight hardware hanQling!lifting equipment prior to use.

Inadequate work control. The workman was not experienced . or qualified and had not been assigned to the job. Contributing was failure to follow required procedures since protective floor pads \o1ere not in place.


Action

" Require QC rece1vmg inspection check of control handles installation on all handling! lifting equipment. Require local QC inspection and verification of all handling! liftin"g equipment used with flight hardware prior to use.

Designate all transport and handling operations involving flight equipment as sa.fety critical and train ano certify personnel for their job. Ensure that only certified personnel participate in sclfety critical handling ope rat ions. Require QC verification that protective pads are in place prior to moving heavy items inside flight vehicles.

f--J o -.:j •

33.

34.


t'1hile machining foam insulation during 360° repair of a spacecraft forward skirt at a manufacturing facility, the rotating aluminum shaft of the machining tool sheared at the base of the phenolic cutting head. The cutting head hit and damaged the insulation.

puring manufacturing operations -involving the removal of a bonded support bracket from the forward dane of a spacecraft, the dome skin was dented in three places.


Causes

Deficient work planning in that the machining tool (aluminum shaft) selected

was inadequate for the assigned work.

Personnel error in that there was failure to follow established procedures when us ing a plastic scraper to separate the bond between the support bracket and the forward dome.


Action

. Avoid the use of aluminum shafts in machining tools. Require engineering design review of machining tools procurement· specifications to ensure their adequacy for use with program essential hardware.

Require that employees be instructed on proper procedures for removing bonded items fran critical flight hardware. Assure that the proper hand tools are available for employees' use when removing bonded articles from flight hardware.

f-' o co

·_---_.-._---..

Accident/Incident Descrlption

35. During manufacturing, a titanium propellant tank loaded on an automatic conveyor was damaged beyond repair \'1hen it jammed into a partially open heat-treat oyen door due to failure of the door lifting mechanism.

•

SECTION IX STRUCTUHAL SYSTEMS

Causes

Deficient design of the heattreat system in that there was no provision for automatic shut-d<xo1I1 of the conveyor if the oven door failed to less than required open position. Contributing was deficient work procedures since the door mechanism was in an incipient failure condition \V'hich could· have . been detected prior to start of heat-treat operations.


Action

Designate all automatic feed operations for flight hardware safety critical. Require safety analysis/review of feed systems designs to ensure incorporation of fail-safe features. Ensure operating procedures require visual/functional check of proper systems operation; prior to start of loading

...

I-' o \D


53. During highway transport of critical program equipment a tractor-trailer interior caught fire approximately 5 hours after it was loaded. The local fire department extingUished the minor blaze. The dl-iver continued and l\ hours later the fire recurred, com·pletely destroying the critical equipment. Destruction and damage amounted to over $800,000.

54. While towing a vertical engine installer to its storage location at a lalUlch facility a crack developed in the installer draw-bar assembly at an area of previous repairs.

SECTION X TRANSPORT/HANDLING

Causes

Failure to enforee no smoking policies around packing and shipping areas and materials. Contributing causes were failure to inspect loading of high value equipment, carelessness of loading personnel, and failure to properly extinguish initial trailer fire •.

Personnel error in that proper towing vehicle operating procedures were not followed. Contributing was inadequate rna:i.ntenance procedures in that multiple repair of the failed area had been made, in lieu of part replacement, which weakened the fa iled part.


Action

Publicize and enforce no smoking regulations in packing, shipping, and receiving areas.

Designate handling and transport of essential GSE a~ safety critical operations; require training m d certification of handling personnel. Ensure that essential GSE parts replacement policies prevent multiple failure repair o£ the same part.

I-' I-' o


55. During preparations for shipment of a propellant tank from the manufacturer a heat lamp was tipped against the outer tank wrapping and started a fire causing minor damage to the tank~

56. During maintenance work on a main stage crawler transporter, three hydraulic steering pistons and related cylinders were severely damaged when the trtlllSporter platfonn was lowered.

.. 1"1


Causes

Procedural in that heat lamps, though not actually required, were used near flammable materials without proper protective devices to prevent ignition.

Inadequate work control in that there was no overall supervision or positive cormnmication during maintenance operations. Contributing were personnel error since the required inspection to verify open position of manually operated isolation valves was not perfonned prior to platfonn lowering, and a design deficiency in that there was no hydraulic over-pressure warning or relief system.


Action

Require that all heat lamps used in presence of flammable materials be equipped with protective devices, and be specifically certified for use in each operation.

Designate all rna intenance and check-out opera-tions on flight hardware tr~,sporter ~quipment as hazardous and certify personnel for such operations. Ensure '.:hat all maintenance operations on such eq~ipment are cOn"CrOlled by one overall supervi.sor. ~:?G:uire -:::1e use of checklis"::s and/or procedures dLWing ~aintenance operations. Equip all hydraulic sub-systems capable of inadvertent overpre'ssurization with relief valves or warning devices.

..... .....

.....

"


57. During removal of an empty tank car, a helium rail car was mistakenly moved while a pressurized hose was still connected between the car and the off-load facility manifold, resulting in damage to the flex hose and bleed panel.

58. A cormterc ial tractortrailer van haul.ing a NASA.awned computer system skidded off the highway into an embanlonent. '1'he trailer jackknifed, causing damage to various computer parts. The driver received minor injuries.-


Causes

Inadequate work control in that the car was moved without first being checked for connected lines; failure of the off-loading crew to set legally required warning flags, and failtme to verify the identity of the car before moving it. Contributing was poor visibility due to night-time cmditions.

Material failure in that an apparently good front tire of the tractor blew out under ideal highway and weather conditions. Contributing were personnel error in that the driver failed to control the vehicle after the blowout occurred, and inadequate procedures in that there was no evidence that vehicle condition or driver qualification had been determined before departure •


Action

Designate propellant offloading opersrions as hazardous and certify off-load crews. Require safety approval of off-loading operations prior to commencement. Require use of a checklist and/or procedures to ensure correct ra,ilcar identification and that all disconnects have been made prior to movement.

Designate highway transportation of high value/program critical equipment as safety critical. Require certification of drivers and inspection of hizhway vehicles hauling critical equipment prior to departure.

I-' I-' N


59. During shipment of a number of space system batteries via convnon carrier trailer truck from the manufacturer plant to the la\D1ch center, the batteries were damaged beyond use due to exposure to excessive heat brought about by failure of the trailer temperature ccnditioning system and failure of an independent temperature gage/sensor assembly.

60. During manufacturing checkout a wheeled leak detector was damaged while being loaded on to skid, when a wheel broke off caus ing unit to fall backwards to the pavement.

.. 111


Causes

Inadequate transportation planning in that there were no procedures to verify the proper operaticn of the conditicn!ng system and its temperature gage system prior to battery loading; there were no procedures to ensure adequacy of emergency actions to be taken on noticing the failure of the temperature gage/sensor assembly (the conditioning unit was heard to be rtuming and it was asswned it was in the IIcool l1

mode when it had actually failed into the "heat" mode due to a short circuit in the ttErmostat assembly).

Material failure. The wheel broke off at a weld. ContribL"1:ing was possible overstressing of the wheel! weld due to rough handling.

Recorrunended Preventive/Corrective

Action

Require verification by authorized supplier and a government representative of proper operation of essential trailer truck cmditicning systems prior to loading program essential equipment for transport. Require safety/reliability review of essential trailer truck conditioning systems to establish compatibility between emergency enroute procedures and failure modes of conditioning equipment, prior to shipment of program equipment.

"I

Require training and certification of all personne.l involved in handling/moving of essential hardware. Require regular maintenance inspection of wheel assemblies on trolley mounted high value/critical test and support equipment. Affix handling warning notices to critical portable equipment and ensure its movement only by certified personnel.

...... f-' tAl


61. While removing a spacecraft cannol unit from the mobile launcher to the high bay during the pre-launch checkout, three calibration test point connections were broken .•

62. NhUe equipment was being unloaded from a cart an the l20-foot level of a mobile launcher, a test box fell to the "On level and was totally demolished. No other danage or personnel injuries Occurred.


Causes

Persamel error since cantrol mlit was moved without protective pads or cases, in violation of established procedures.

Persormel error in overloading the cart, intermingling flex hose with other apparatus, and unloading cart while too close to the edge.


Action

Require QC inspection and verification of proper packag~ protection of high value test equipment prior to movement.

Establish procedures and controls to prevent over-loading and hazaroous handling of carts. Require that personnel handling movable carts around and on launch supgort structures be properly trained and certified for their jobs. Provide protective side barriers or nets on carts. Require cart loads to be secured by nets or other arresting methods before bein~ moved across catwalks. Specify and enforce safe load limits for equipment carts •

J-' J-' ~ •

'111

........

. Accident/Inc1dent Descr1ption

63 •. During the moving of test equipment on a cart across a can"alk, a S-lb. test box . fell from the cart over 100' to·a lower level and was demolished~ No personnel injuries or other equipment damage resulted.

6lJ. During facility modification, a 190-lb. steel heat shield panel was be ing hoisted by~n overhead crane Nhen the handling tool attached to the panel failed and the panel fell against a space vehicle engine, damaging lJ. lines beyond repair.

. ,.

4 ",

,I. ,.1,

SECTION X TRANSPORT/HANDLING.

Causes·

Personnel error in that the cart \l1as overloaded with loose, unsecured equipment. Contributing t-Jere failure to exercise proper supervision and to provide side fencing or netting on catwalk.

Procedural error in that a handling tool not de~ signed for the specific job Nas Used. There was no tool for lifting the· steel panel so one used . for lighte~r ceramic panels was utilized. Contributing causes were failure to provide formal authorizati.on of lift ing tool substitution, failure to provide instructions on lifting tool limitations, failure to require safety L'1spection of the lift rigging, and failure to·· provide support for the· shield while taking up cable slack.· ...

: .

..

Recormnended Preventive/Corrective

Action

Establish procedures and controls to prevent over-loading and hazardous handling of carts. Require that personnel handling movable carts arOlmd and on launch sup?ort structures be properly trained and certified for their jobs. Provide protective side barriers or nets on carts. Require cart loads to be secured by nets or other arresting methods before bein~ moved across can.za.lks. SIlg-cgy and tmfg:rc~ ~ilft: :Leild limits for equipment cart!.

Require safety approval and . surveillance of facility modification hoisting operations in vicinity of flight systems; require inspection of all rigging prior to use. Establish procedures \o:hich restrict tool use to the jo!:J for \I1hich designed . and require formal approval of any substitution.. Require listlllg of proper tool use and any limitations on tool dra,,,ings. and ensure that personnel engaged in critical lifting operations are at'lare of this information.

,I,'

I-' ...... \J1

~I

Accident/Inc1dent _~scription

65. Two workmen inhaled toxic fumes generated by smouldering containers of oil, acid and solvent which spontaneously ignited at a test facility dtmlp, due to incompatibility between materials be:ing dumped.

66. During local truck transport of a spacecraft capsule at a Center, the capsule caught on and broke a fire alarm communications cable over the roadway, resulting in minor damage to 5 private vehicles parked nearby. Negligible damage to the capsule.


Causes

Inadequate work planning and procedures in that the disposal operations did not provide for the identification and segregation of potentially hazardous material combinations.

Inadequate transportation planning in that overhead clearances along the route were not verified beforehand.


Action

Require identification and segregation of hazardous materials comb inat ions in planning disposal procedures. Ensure that disposal personnel are adequately briefed on the potential hazards of waste materials and on the necessity for wearing protective gear.

Require route inspection and verification of adequate overhead road clearance in planning transport of flight equipment.

'-, '-' CJ\


67. During airport gro\.Uld handling operations, a crate~ pallet mounted, spacecraft oxygen tank being shipped from the manufacturer slipped off a transporter and fell 3 feet to the ground. There was no damage to the tank and only minor damage to the reusable container.

68. While a workstand section was being moved during assembly of a spacecraft module, a wheel on the workstand caught on B floor joint, causing the workstand to pivot and strike the module propulsion system radiator.

. ~


Causes

Personnel error in that the transporter operator had installed only 2 of 6 chocks designed to prevent load slippage. Contributing was failure to mark the container as critical flight hardware and failure to notify the shipper of the critical nature of the cargo.

Inadequate work control in that the workstand was being. moved with the help of an electric work saver and there were no restraints employed to prevent erratic movement of the workstand.


Action

Clearly mark all shipments of critical flight hardware as flight critical an the container and include special handling instructions. Ensure that shippers are notified of flight critical shipments.

Prohibit use of assisting equip. ment which cannot be controlled with required precision. Require strategic placement of adequate restraints to prevent erratic movement of workstands during their movement around flight hardware.

..... ..... ~

69.

70.

."


\'lhile moving a spacecraft module control \mit, a forklift went over a bump; unit bounced, breaking the pallet and fell 2-3 feet to the pavement, then roll~ 5 feet in front of the forklift, resulting in damage to the unit.

During off-loading of a crated vehicle stage helium ambient sphere by forklift from a truck, the sphere crate was dropped due to imbalance and insecurity on the forklift , resulting in loss of the sphere for production use.


Causes

Inadequate work control in that the movement of the \mit was undertaken without proper secur ing to. the pallet and forklift.

Personnel error in that the operator apparently misjudged the balance of the crate as it was being lifted and possibly did not use long enough forks. Contributing causes were failure to use straps or restraining devices while handling flight critical hardware, failure to clearly mark the shipment as critical hardware and to inform the shipper, and failure to properly supervise unload-ing of critical equipment.


Action

Require that forklift transport procedures on critical! high value spacecraft hardware include the equipment for tie-down before movement. Require all forklift operators handling such items to be certified.

Ensure that all critical program hardware shipments are clearly marked on the crate as critical equipment. Require crated critical equipment to be clearly marked with CG locations and lifting points. Require personnel involved in handling critical equipment to be trained and certified for their job. Ensure adequacy of supervisory control during forklift handling of critical equipment to ensure use of correct fork lengths and attention to load ba.lance •

~ ;-: c.)


71. During installation of an ascent stage in a workstand, one of four hydraulic lifting jacks failed due to hydraulic leak allowing the corner of the stage to drop approximately one inch. There were no personnel injuries or flight equipment damage.

72. While transporting 4 drums on a pallet in a manufacturing receiving area, a forklift struck and broke one corner of a fiberglass container placed in the passageway and slightly damaged spacecra.ft Control and Display Panel inside. There were no injuries.

•


Causes

Procedural deficiency in the selection of the jacks used in that they were prone to sudden failure due to hydraulic leak. Contributing was inadequate work control in that the rrrocedural requirement to position the jack ram locking ring to limit any stage drop to 1/8 inch was not complied with.

Deficient receiving area procedures which failed to provide for adequate protection of in-transit program essential equipment.


Action

Prohibit use of margina1/ deficient handling/positioning gear in movement of essent ial program equipment. Identify such gear as safety critical and establish formal design! engineering control for procurement and selection. Require supervisory review of handling/positioning procedures with handling team prior to movement of essential equipment; maintain supervisory control during movement operation.

Require periodic (at least quarterly) safety reviews/ surveillance of receiving area/warehouse procedures and activities to ensure segregation of fragile material not requiring mechanized handling equipment from heavy bulky material; to ensure adequate passageways are provided for transit of handling equipment.

~ "

......

...... 'P

.'


73. \'fulle lifting a spacecraft hydraulic accumulator from its shipping container, the heavy end slipped from the mechanic's grasp and fell 6 to B inches. damaging an electrical connector attached to a potentiometer within the reservoir.

74. During a helilUtl transfer operation, the truck driver attempted to move the tube trailer, while it was still connected to the supply system, resulting in damage to the high pressure flex hose, the system manifold, the line leading away from the parking area, and the tra iler discharge manifold.


Causes

Personnel error due to improper handling. Contributing was failure by supervision to detennine the adequacy of methods and protection being used while remov ins the accumulator from its shipping container.

Inadequate work control in that the trailer was reconnected to the system for leak checks, after it was called to be moved by the test support crew, and the driver on arrival was not so informed.. Contributing was persOllJ1l!l error since the driver did not visually determine that trailer was disconnected •


Action

Require that unpacking procedures for items of flight hardware and components include a. step for supervision! inspection determination as to the need for use of any special handling or protective measures, prior to proceeding with unpacking operations.

Require that warning or caution signs/flags be placed on front and rear of trailers while connected to a transfer manifold, and permit removal only after the joint inspection by both the truck driver and the supervisor of the supply system.

..... f\) o


75. While slow towing a helium rail car, a trackmobile derailed, damaging a mechanical track switch and sustaining minor structural damage. The switch had to be replaced.

76. During installation of portable clean roans in a test tower, a hoist cable caught the reflector of a fluorescent light fixture, pulling loose the reflector and two 48-inch lamps. The lamps broke, scattering glass an a space vehicle. There was potential for mercury contamination of the vehicle.


Causes

Inadequate design of the control levers since all three were the same color, only l~" apart, and were not equipped with a positive safety lock to prevent inadvertent movement. Contributing was personnel error in that the rubber wheels were placed in the "down n pos ition erroneously, thereby disengaging the flanged track wheels.

Fa ilure to follow required procedures in that workmen did not adequately monitor cable clearance during operations. . Contributing was failure to provide protection for the space vehicle during hoisting operations.


Action

Require human factors/safety review/analysis of manual control systems designs during their development to ensure man/machine compatibility; provide safety locks on manual control levers. Require training and certification of transport/handling personnel.

Designate all hoisting and lowering operations near flight systems as safety critical and require safety inspection of rigging and system protection . prior to conmencing operaticas., Ensure that safety training and awareness programs positively emphasize the critical nature of hoisting/handling operations on or near flight hardware.

..

f-' I\) f-'

77.

78.

..


During inspection of an instrumentation flight module after removal from storage, two indentations in the exterior s,tructure were found. The damage was minor.

During stage rotation from vertical to horizontal position in preparation for shipment from the manufacturing f;.cility, the protective cover of the stage feed line contacted the upper structure of a nearby forklift, resulting in minor damage to the cover.


Causes

Improper storage and handl ing . techniques in that the module was apparently stored with insufficient clearance between the unit and the storage station post, which cause~ a gather in the dust cover to be pressed into the side of the unit. Contributing was personnel error in not exercis ing due care in storage operations.

Inadequate work control in that sufficient clearance for the stage rotation path was not established prior to movement.

RecoliUllended Preventive/Corrective

Action

Require formal storage procedures and specifications for critical end items. Require OC inspection to ensure that critical end items are stored in accordance with ~pecifications.

Ensure that r.10Ve conductors ex'" ercise rigid control of area operations during movementl repositioning of flight vehicles. Require barricading placardin~ of area opera~ions ~rior to start of move.

. , :

I-' I'J I\)

Accident/Incident ~ Aescription

79. During transporter movement of spacecraft subassemblies within a plant, the transporter struck the top of a doorway, causing minor damage to the subassemblies.

80. During removal of a dy'llamic test article from manufacturing checkout facility building, the mobile crane handlil1.~ the aft end of the unit was overloaded, causing the front (tractor) end 0:: the crane to rise off the ground and permitting several feet of Wlcontrolled movement of the flight unit. No damage or personnel injuries occurred. However, accident/injury potential was high.


Causes

Personnel error in that the driver did not make a visual check prior to driving through the doorway.

Inadequate functional verification procedures for verifying the safe operation of the crane, which failed to consider the effect of motion on the crane's carrying capacity. Verification under load had been performed only under stationary conditions.

Recorrunended Preventive/Corrective

Action

Require full stop visual check for adequate clearance when moving flight hardware and program equipment through doorways. Provide clearance caution and warning placaro.s on doors and exits used by plant transport vehicles.

Ensure that procedures for all moving of critical flight hardware include requirements for pre-use fWlctional certification of transporting equipment both under load and motion conditions. Require periodic review and certification of preparation and readiness procedures associated with "critical move" operatioos.

I-' I\) UJ .

,"


81. During receiving inspectian at a NASA Center, a ~ission module was found to have a high level of radiological contamination. Although no damage or injuries resulted from this incident, a similar situation could result in a serious accident.

82. During Highway transport, a cargo of high-value electronic equipment broke loose from the tie-down ropes aboard a truck and the equipment fell over onto the bed of the truck and some on to the side of the road. Two fuse distribution racks were destroyed.


Causes

An unauthorized modification, in that maintenance personnel replaced the l/ll" thick plastic shield on the instrumentation panel with a 1/16" thick shield which warped and, during transport:, vibrated enough to rub radioactive paint off the panel. Contributing \>las an inspection deficiency in that the shipment was not inspected and approved by the Radiological Safety Officer prior to dispatch.

Procedural error.s by both the trucker and the shipper. Trucking operator did not comply with procedures for proper tie-down and protec-tionof high-value/programcritical equipment while in transit, and the shipper did not notify the trucker that the load to be transported was high-value/ critical, as required. Contributing cause was material failure in that the tie-down rope broke, because it was worn and not of required working strength.


Action

Prohibit substitution of nonstandard materials in all critical hardware or flight equipment without prior approval. Require engineerin~ hazard analysis prior to approving such material substitutions. Ensure that all radioactive shipments are labeled as hazardous and require inspection. and approval by Radiological Safety Officer.

Require formal safety inspection of all packing and loading operations involving high-value! critical end-item hardware. Require safety inspection of all trucks and certification of all drivers included in transport of high-value/critical end item hardware. Ensure that truckers are notified and aware of those shipments which contain highvalue/critical. end item hardware. Require safety inspection and verification of adeql.iac~1 of tiedown ropes and cables.

I-' IU ~

I"

83 •.

84.


During movement and pos itioning of a stage transporter at a manu:facturing facility, the driver backed the equipment into a stanchion, damaging the access ladder to the forward truck steering cab.

\'lliile guiding a hydraset to the floor in a manufacturing and assembly facility, employee's finger was caught between the load and the floor, resulting in the loss of l-l/l~ fT of finger.

~tI


Causes

Inadequate work control in that procedures requiring stanchion removal prior to moving vehicle were not followed and communications were relayed by both observer and superv isor, caus ing driver misunderstanding.

Inadequate work control since the load was set down before ascertaining that the individual guiding the operation was clear and ready for load's contact with the floor.


Action

Require checklist verification by move conductor or supervisor that all pre-move procedures have been followed prior to moving transporter or major end item hardware. Require one observer for each side during transporter movement and enSl~e that only one person relays instructions to driver.

Require that procedures for lowering and hoisting operations be periodically reviewed to assure they are adequate for current operations. Ensure that superV1S1on is adequate and present during such operations.

..

t--' l'\) \J1

t

Accident/mcident Description

41

85. While being transported from storage on a flat four-wheeled dolly, B VHF ranging console fell off when a dolly wheel slipped into a crevice at the entrance of an elevator, resulting in minor damage to the console, and injury (broken leg) to one employee. Extensive checkout testing had to be performed on the console.

86. During assembly of a thermal systems unit ('l'SU) t a cable assembly in the rigging hoistblg tool failed when a swaged cable loop pulled loose t dropp,iJig the TSU carmister lJ. feet to the floor, caus ing minor structural damage. No personnel injuries.


Causes

Inadequate pr~edures for handling and transporting high value equipment in that the load was not secured, the skid roller dolly was not an approved piece of equipment for transport of high value equipment, and clearance space between elevator and floor was not properly bridged.

Material failure in that a swaged cable connection which had been properly proof tested 8 weeks earlier suddenly failed under load. Contributing causes were possible improper distribution of the load and possible contamination of the cable sleeve with lubrioant from the wire cable.

I'


Action

Require that transport equipment be certified and approved for transport of critical hardware items and ensure periodic reinspection. Require that formal procedures and checklists be utilized in movement of any critical hardware.

Avoid the use of swaged cable connection in hoisting assemblies UBed for moving critical hardware. Require all such assemblies be designed with U-bolt wire rope clips for the cables. Establish procedures for safety inspection to verify proper condition of hoisting tools prior to each use. Determine CG for each load prior to lift and adjust rigs accordingly.'

f-' I\)

0'1 .


87. During rece1V1llg operations. a vacuum pumping unit was being removed by forklift from a truck when the unit suddenly tipped toward and struck the truck bed, resulting in extensive external and internal damage to the unit.

88. During manufacturing, a launch vehicle digital computer page assembly was inadvertently dropped while being hand-carried in a process laboratory, resulting in minor damage to the assembly and a non-flightworthy disposition.

·1


Causes

The primary cause was inadequate handling techniques in that the forklift operator used forks which did not extend the full width of the shipping pallet and failed to detect the resulting load imbalance. Contribut ing causes were failure to mark the shipment as critical equipment amI lack of superv is ion of critical handling operations.

The primary cause was inadequate handling techniques in that flight critical hardware l'18S not protected from inadvertent damage during transport/handling. Contributing causes were failure to designate the page assembly as flight critical, and failure to inform personnel that the assembly was for flight use.


Action

Designate critical progra~ equipment handling operations as safety critical and require training and certification of personnel. Require all program critical equipment to be clearly marked as sucn for shipment and ensure that such shipments are marked with CG locations and lifting points. Ensure adequacy of supervisory control during forklift handling of essential equipment, to ensure nse of correct fork lengths and attention to load balance.

Require positive protection of program critical hardware during transport!handling in process laboratories/facilities; require use of padded carts in lieu of handcarry between process stat ions; minimize manual handling; ensure that critical hardware is identified as such.

..

I-' T\) -.J

AccIdent/Incident Description

89. During manufacturing handling operations, the cover of a container holding a thin-walled spacecraft He tank hit the tank when a workman dropped it into the supposedly empty container. There was no damage.

90. During the handling of a stage tank assembly, the forward and aft tank domes were damaged slightly by the tank handling rings.

91. During shipp ing preparation operations, outgassed hydrogen/oxygen from a recently discharged silver/zinc battery in a hermetically sealed drum was ignited by a spark generated by the scraping of the battery against the side of the drum and exploded, blowing the lid from the drum, charring dessicant bags within the drum, and causing minor injury to one person.


Causes

Personnel error in that no visual check of the shipping container content was made before dropping in the cover. Contributing was lack of external markings indicating critical and fragile nature of contents.

Inadequate maintenance and inspection of handling equipment since the heads of the screws \\lhich attach the rubber protective pads to the handling rings had surfaced through the pads and caused the scratches.

Inadequate handling/transportation/storage techniques in that the battery was placed :in the drum too soon after discharge; (it is char'acteristic 0: silver/zinc battel'ies to out gas bot;. hydrof';cll anc oxygen for several hours afte::..' dischar~e). Also, trle Latter',',' was not secured inside the container.

"


Action

Designate critical end -item handling and transport operations as safety critical and require all personnel involved to be trained and certified. Require visual verification of contents prior to mov ing or insert ing anything into equipment containers.

Ensure adequate maintenance of specialized equipment used with flight hardware, and require a pre-use inspection.

Ensure silver/zinc battery shipment procedures require a delay of not less than '+8 hours after discharge before sealing in s:1ippir.~ container. Require batteries to be secured inside S;:iDpinf containers.

...... I\) <Xl


92. During transport operations a parked, tm

attended tractor-trailer rig containing high value flight support equipment rolled downgrade thro~, a fence, causing minor damage to the rig, but no damage to the cargo •

'I' ~

I,


Causes

Personnel errOl' :in that the driver failed to secure the parked vehicle in accordance with approved procedures.


Action

Require use of a checkl.ist for operation and parking of transport vehdcles containing program criticallhigh-value hardware, and establish a safety training and awareness program for drivers to motivate canpliance.

"I

ACE ASI . ASME CG C02 CRS DB ECS EO GH2 GN...2 GSc He Hz KOH LH2 LN2 LOX. N20 4 LUT

2tp PSI PSIA PSIG QC QD Q&RA RCS R&D

. RF RPM SCAPE SCFM TC TCD TCP TPS TPI TV TVD UDMH VDC

APPENDIX

GLOSSARY OF

ABBREVIATIONS, ACRONYMS AND TERMS

Automatic Checkout Equipment Apollo Standard Initiator American Society of Mechanical Engineers Center of Gravity Carbon Dioxide Cold Rolled Steel Design Burst Environmental Control System Engineering Order Gaseous Hydrogen Gaseous Nitrogen Ground Support Equipment Helium Hertz (cps) Potassium Hydroxide Liquid Hydrogen Liquid Nitrogen Liquid Oxygen Nitrogen Tetroxide Launcher Umbilical Tower Oxygen Operational Checkout Procedure Pounds Per Square Inch Pounds Per Square Inch Absolute Pounds Per Square Inch Gauge Quality Control Quick Disconnect Quality and Reliability Assurance Reaction Control System Research and Development Radio Frequency Revolutions Per Minute Self Contained Atmospheric Protective Ensemble Standard Cubic Feet Per Minute T est Control/Test Con9uctor Test Checkout Directive Test Checkout Procedure Test Preparation Sheet Threads Per Inch Television Toxic Vapor Disposal . Unsymmetrical Dimethylhydrazine Volts, Direct Current

129.

APPENDIX (CONTINUED)

Accident

Incident

Cryogenics

"0" Water

Dewar

Hardware -

Software

"Hoke" Bottle

"K" Bottle

"Kluge"

Program Phase

Program Activities-

A type A or B mishap as defined in the NASA Safety Manual, NHB 1700.1 (VI)

A mishap of less than accident severity as defined in the NASA Safety Manual, NHB 1700.1 (VI)

The science of producing and the application of low temperature processes below minus 1500 F and the techniques involving handling, storage and usage of liquified gases. Examples are hydrogen, oxygen and heli um.

Distil/ed water.

A double walled metal vessel or tank, with an evacuated space between walls, used for storing fuels and propellants in a liquid state.

Any program component, subsystem, system, module, stage or vehicle, plus any facility equi pment and property, ground support equipment (GSE) and other used in direct support of program hardware.

Any formalized written policy, directive, procedure, plan, specification, requirement or analysis prepared as an essential tool in the conduct of program activities.

A sma" pressure vessel or container used in obtaining, handling and transporting gases and liquids for sampling ~

A portable pressure cylinder or t<:Jrlk commonly used as a pressurEl source.

A frequ-entTy LJSedsTang -terndor a temporary or unauthorized installation.

The four phases of a major research and development/ operations program as defined in the NASA Phased Project Planning Guidelines, NHB 7121.2, August 1968 Edition.

Tasks, work, functions and responsibilities associated with program hardware development/operations as defined in NASA Phased Project Planning Guidelin~s, NHB 7121. 2, August 1968 Edition.

I 1 I'

J]G

Documents

MANNED SPACE PROGRAMS ACCIDENT/INCIDENT … · NASA CR-120999 MANNED SPACE PROGRAMS ACCIDENT/INCIDENT SUMMARIES (1970 -1971) Cranston Research, Inc. Alexandria, Virginia prepared